Moonshot's new desktop agent swaps the cloud sandbox pattern for local files, a real browser session, and on device scheduling — though the 300 sub agent swarm figure and K2.6 engine still carry attribution caveats heading into fact check.
The cloud-sandbox agent that dominated 2024 and 2025 is a remote browser you do not own. Moonshot AI's new Kimi Work, a local desktop agent running on Kimi K2.6 with an agent swarm reportedly scaling to 300 sub-agents, is the first serious attempt to move the agent off the cloud and onto the metal.
That move changes three things at once: where the data lives, what the agent can touch, and who owns the session.
Kimi Work is positioned as a direct counter to the architecture that defined the last two years of AI agent design. Instead of a hosted sandbox with a throwaway browser profile, the agent runs locally on macOS or Windows, reads files on the user's machine, drives the user's real browser with its existing logins, and executes scheduled tasks on a built-in cron. The product page on Moonshot's own kimi.com describes a tool aimed at knowledge workers whose bottleneck is access to local files and live sessions, not at building another remote agentic sandbox.
The headline number is 300. Per an aggregator write-up of Moonshot's announcement, Kimi Work orchestrates a swarm said to scale to 300 sub-agents on top of K2.6, a Mixture-of-Experts model. K2.6 is confirmed as Moonshot's current flagship model per the kimi.com homepage. The 300-agent figure and the swarm's documented 4,000-step ceiling are attributed to Moonshot's release materials in secondary reporting; neither appears on the primary product page itself. Both still carry an attribution caveat heading into fact-check.
K2.6 is described in community discussion and secondary reporting as a sparse Mixture-of-Experts with roughly 32B active parameters and a 256K-token context. K2.6's open-weight release date of April 20, 2026, appears in the same secondary reporting. Those specs need primary-source confirmation before they can be treated as settled fact.
The architectural bet is a swarm running locally on a 32B-active MoE — a different cost and trust model than a 300-agent swarm behind a hosted API. The bill, the latency, and the blast radius all move with it.
The trust model is the part the launch materials do not address. An agent driving a real logged-in browser inherits that browser's session: cookies, tokens, payment flows, and any prompt-injection surface those pages expose. A cloud sandbox with a throwaway profile has a smaller blast radius. A local agent running on the user's machine, with access to local files and the user's real session, can do more damage when something goes wrong, and the audit trail is the user's machine, not a vendor's logs.
The product page confirms four building blocks: the Agent Swarm, WebBridge (a browser extension using the user's real session), the Cron scheduling engine, and local file/code access. The FAQ notes an "Ask before acting" safeguard that prompts for authorization before modifying files or running code. The scheduler supports LLM Agent Calls, Python, and shell executions, with a "Keep Computer Awake" toggle for overnight jobs. Finance-specific data integration covers A-shares, HK stocks, and US equities, with output to PowerPoint and Excel.
The category framing — privacy, offline execution, on-device control — is editorially attractive, but has not yet been corroborated by independent reviewers or hands-on tests. The captured sources are a secondary aggregator's write-up of a Beijing lab's announcement and Moonshot's own product page, posted the same day as the launch. Cross-checking Moonshot's primary announcement channels for the official 300-sub-agent ceiling, K2.6 engine specs, and download URLs remains a pending reporting step.
Open questions include: whether the 300-agent ceiling is a product limit or marketing line, what hardware floor the local swarm requires, what permissions model governs the real-browser session, and whether the scheduler's triggers are auditable.
What to watch: whether the 300-agent ceiling holds under independent testing, whether K2.6 is confirmed as the engine, and whether a second Western lab ships a comparable local agent within the quarter. The local-agent bet is a thesis, not yet a trend. Kimi Work is the first test case.