What is the safest way to run autonomous coding agents unsupervised overnight?

Run them on a machine that is not yours, with no route to the internet except an allowlist, no long-lived credentials, and no power to merge. As of November 8, 2026 the easiest setups that meet that bar are a cloud agent that works in a throwaway VM and ends by opening a pull request (Cursor Cloud Agents run each agent in its own Firecracker microVM; Codex cloud blocks internet during the agent phase by default), or a local Docker container with the repository mounted and outbound traffic restricted. Running an agent directly on your laptop in a bypass-permissions mode is the unsafe option.

Is Claude Code's built-in sandbox enough for overnight runs?

It helps but it is not a complete boundary. The sandbox is off by default; once on, shell commands can write only to the working directory and temp, and network traffic goes through a proxy whose allowed-domain list starts empty. But by default sandboxed commands can still read most of the machine, including ~/.ssh and ~/.aws/credentials, inherit environment variables, and Claude's file tools, MCP servers and hooks run outside the sandbox. For unattended runs, add denyRead rules for credential paths or run Claude Code inside a container or VM.

What should an overnight coding agent be allowed to do?

Read and write one repository, run its tests, reach the package registries it needs, and push to a branch. It should not be able to merge, deploy, read your home directory, reach arbitrary websites, or hold production credentials. Make its only output a pull request a person reviews in the morning, set a spend cap with the model provider, and keep a log of every command it ran.

Why is internet access the biggest risk for unattended agents?

Because prompt injection turns any web page, issue or dependency README the agent reads into instructions, and an open network lets it send your code or secrets somewhere. OpenAI's Codex documentation gives the example of a GitHub issue that tells the agent to pipe git output to an external server. Block egress by default, allow only the domains a build needs, and where possible restrict HTTP methods to GET, HEAD and OPTIONS.

Quick Answer

Safest Way to Run Autonomous Coding Agents Overnight

Published: November 8, 2026

The short answer

The safest overnight setup is a disposable machine, a closed network, no standing credentials and a pull request as the only output. Nobody is watching at 3 a.m., so every protection has to be enforced by the environment, not by an approval prompt you will not see. As of November 8, 2026, in order of safety:

A cloud agent in a per-task VM that ends in a PR — Cursor Cloud Agents, Codex cloud, Claude Code on the web, GitHub Copilot cloud agent.
A local container (Docker or a VM) with the repo mounted and an egress allowlist — when code cannot leave your network.
Claude Code’s sandbox on your own machine, hardened — acceptable with credential paths denied and a domain allowlist.
An agent on your laptop with permissions bypassed — do not do this unattended.

The options compared

Setup	Isolation	Network default	Credentials exposure	Output	Overnight verdict
Cursor Cloud Agents	Per-agent Firecracker microVM in a separate AWS account	Configurable network access modes	Repo access inherited from the triggering user, never widened; secrets configured per team	Branch + PR for human review	Safest turnkey option
Codex cloud	OpenAI-hosted container per task	Internet off during the agent phase; setup scripts have internet	Only what you put in the environment	Diff / PR	Safest default network posture
Docker container you run	Container boundary; only mounted paths visible	Whatever you configure (use an allowlisting proxy)	Only what you pass in	Commits to a branch	Best when code must stay on-prem
Claude Code sandbox (local)	OS-enforced limits on shell commands only	Proxy with empty allowed-domain list	Reads ~/.ssh and ~/.aws by default unless denied; env vars inherited	Local commits	OK only once hardened
Local agent, bypass permissions	None	Open	Everything your user can reach	Anything	Never unattended

Facts from each vendor’s documentation on November 8, 2026.

Step 1: Put the agent on a machine you can throw away

A VM or container that dies after the run limits the blast radius of a bad command or a malicious dependency to that box. Cursor documents that each Cloud Agent gets its own Firecracker-based microVM, that the VMs run in an AWS account separate from the rest of Cursor’s production systems, and that VMs are hibernated and deleted on lifecycle timers after the run. Locally, the equivalent is one container per task with only the repository mounted. Our Docker vs process vs remote sandbox guide covers the trade-offs, and best AI agent sandboxes ranks hosted runtimes.

Step 2: Close the network, then open only what the build needs

This is the control that matters most unattended. OpenAI’s Codex cloud blocks internet access during the agent phase by default, while setup scripts can still install dependencies. If you enable access, Codex offers a “Common dependencies” allowlist preset (package registries and source hosts) and lets you restrict methods to GET, HEAD and OPTIONS, which stops the agent from POSTing your code anywhere. Claude Code’s sandbox routes traffic through a local proxy whose allowed domains start empty. Whatever runtime you use, the rule is the same: default deny, allow registries, block everything else.

Step 3: Remove standing credentials

Claude Code’s documentation is explicit that, by default, sandboxed commands can read credential files such as ~/.ssh and ~/.aws/credentials and inherit environment variables. Before an overnight run, deny those paths (filesystem.denyRead), scrub the environment, and give the agent only a short-lived, repository-scoped token. Cloud agents help here: Cursor’s agents reach code through the Cursor GitHub or GitLab app, with access limited to what the triggering user can already see. Our guide to giving agents credentials without leaking them has the patterns.

Step 4: Make a pull request the only way out

An agent that can merge or deploy can do damage before you wake up. Let it push to a branch and open a PR; Cursor’s Cloud Agents open pull requests for a human to review before anything merges. Protect main with required reviews and CI so even a compromised agent token cannot land code.

Step 5: Cap spend and keep a log

Set a budget limit with your model provider or agent platform, cap the number of turns or the wall-clock time, and keep the full command log. A loop that retries a failing test for eight hours is the most common overnight failure, and it is a billing problem rather than a security one.

Know what the sandbox does not cover

Claude Code’s sandbox wraps shell commands only. Claude’s built-in file and web tools, MCP servers and hooks run outside it, and on native Windows commands run unsandboxed (use WSL2). If an MCP server has write access to production, the sandbox does not help. Audit every MCP server and hook before leaving an agent alone with them, as described in our permission modes guide.

A pre-flight checklist

Fresh VM or container; repository mounted, home directory not.
Egress default deny; registries allowlisted; write methods blocked where supported.
No SSH keys, cloud credentials or production tokens in reach.
Branch-only push; main protected; PR as the deliverable.
Spend cap and time limit set; command log retained.
MCP servers and hooks reviewed, read-only where possible.

Last verified: November 8, 2026.