How it is kept safe. And where it is not.

What follows was tried on a real installation, as an agent would: with every right inside its own machine.

What one agent can reach of another

Two agents, two machines. The first was given a folder and a key. The second was given nothing, and looked for both.

The first agent, in its room

$ ls /resources/client-a
contract.txt
$ echo "my key: ${CLIENT_A_KEY:+it is here, and I can read it}"
my key: it is here, and I can read it
$ sudo ls /run/secrets
CLIENT_A_KEY

The second agent, looking for them

$ ls -A /resources
ls: cannot access '/resources': No such file or directory
$ echo "its key: ${CLIENT_A_KEY:-none}"
its key: none
$ sudo find / -xdev -name contract.txt | wc -l
0
$ ping -c 1 -W 3 (the first machine)
1 packets transmitted, 0 received, 100% packet loss
$ (its port 22)
closed

Tried on 13 October 2026, on Ubuntu 24.04. The commands are the ones shown; you can run them again on your own installation.

A real run, as it looked

On the test installation, a call from outside woke the tool twice. The tool here is a plain shell asking a question, so that the pictures show the mechanism and nothing else. The three models are real.

“Shall I go on?” All three said yes. It was typed.

The log of one answer: each of three models, by name, says yes and why; under it, the screen they read.

“Delete them?” All three left it to the owner. It stopped.

The conversation says it stopped and waits for its owner, with the reason; the log shows each model asking for the owner.

Three kinds of keys

The key	Where it is	Can the agent read it?
A key you hand to one agent	In that agent's machine, in memory, gone when the machine stops.	Yes. That agent only. No other agent, and the page never shows it back.
The key that sends code out	On the host, sealed. Used when you press Send.	No. It never enters any machine.
The password of a mailbox	On the host, sealed. The mail is copied into a folder.	No. The agent reads the copies and cannot write to the mailbox.

When it answers in your place

Off unless you turn it on, agent by agent, with objectives and a charter you write.
Several models of different makers must all give the same answer.
First real trial, “Delete this folder?”: one said yes, one refused. Nothing was typed.
A limit of answers in a row, a log of every one, and your phone told when it stops.

What it does not protect you from

An agent can do anything inside its own machine, and with what you attached to write.
It has the network unless you cut it, and what it reads is sent to the AI model it uses.
A text planted on its screen can mislead every model that votes, at once.
From its machine it can knock at your host's own doors, like anything on your network. Keep them locked.

Compared with what you may already have

	What it leaves to you	Here
tmux over ssh	The agent has your whole computer and every key on it.	A machine of its own, with only what you attached.
A container	The host's kernel is shared; rights, keys, wake-ups and the send step are yours to build.	A virtual machine each, and those four are there.
The tool's own remote control	One tool, on your computer, with all of it in reach.	Any command-line agent, several at once, each apart.

Back to the home page →