Give your agent its own machine

Coding agents do their best work in auto mode, when you stop approving every step. But on your laptop, an agent in auto mode can do anything you can do, with everything you have.

What an agent in auto mode can reach

Your laptop is not only where your code lives. It holds your tax returns, your bank statements, your medical records and your family photos. It sits on your home network. An agent in auto mode works right next to all of it.

Most of the time, the agent does what you asked. One mistake is enough to cause damage:

• It reads a file it should not. While it looks for a config file, the agent opens a folder of personal documents. Everything it reads goes to the model, so those documents are now in your model provider’s logs.
• It deletes something you cannot get back. One wrong cleanup command, and files that were never in git are gone.
• It installs a bad package. A routine npm install pulls in a compromised dependency, and that code runs on your laptop with your access.

Then there is the attack that is not a mistake. A prompt injection hides instructions in a web page, an issue or a file that the agent reads. The agent follows them and works against you, with the same access to your files and your network.

So you watch every step, and the agent is only as fast as you are.

How a separate machine answers each risk

Give your agent its own machine. Droneship runs each coding agent on its own machine in the cloud:

• Your files are not there. The machine has a copy of your repo and the tools the agent needs. Your documents, your photos and your home network stay on your laptop, out of the agent’s reach.
• A mistake stays on the cloud machine. If the agent deletes files or installs a bad package, it happens on that machine, not on your laptop. Its work reaches your laptop only through git, when you pull it, review it and merge it.
• It connects only to the sites you allow. Each project has a list of allowed sites. A request to any other site fails, so an injected instruction or a bad package cannot send your code wherever it wants. When the agent needs a new site, you allow it with one click.

So you can leave the agent to work, and review the result when it is done.

What the video shows

The video opens with three public reports of agents deleting files on laptops. The rest is one real run, from start to finish.

1. Start 3 agents. In each repo, one command starts Claude Code on its own cloud machine:

droneship run claude

The machine copies the repo from GitHub, not from your laptop, so push your work first. The 3 agents then work at the same time.

2. A site that is not on the list is blocked. One agent tries to reach www.notion.com. That site is not on the project’s list of allowed sites, so the request fails.

3. Allow it with one click. The blocked site shows on that agent’s Network tab in the Droneship console. Click “Allow”, and the console says:

Saved and applied to 3 running sandboxes.

The rule is for the whole project, so all 3 agents can now reach the site. Nothing restarts. The agent tries again, and the request works.

4. Review, then merge. The work comes back through git. Run these in your own copy of the repo:

droneship diff --stat
droneship pull
git merge --ff-only droneship/main

droneship diff shows what the agent changed. droneship pull brings the work into a separate branch, droneship/main, and does not touch the files you have open. You merge only when you are happy with the work.

Try it

Droneship runs Claude Code and Codex today, from macOS or Linux.

curl -fsSL https://droneship.run/install | sh
droneship login
droneship run claude

The first run asks you to sign in to your Claude plan inside the machine. To use an API key instead, save it once on the console’s Settings page, under Model keys, or export ANTHROPIC_API_KEY and run droneship run claude --byok ANTHROPIC_API_KEY.

droneship login opens your browser so you can sign in. For a public repo, that is all. For a private repo, run droneship connect once to give Droneship access on GitHub.