How do I run a coding agent unattended overnight safely?

01Steps

1. Put the work on its own branch. Commit everything first. The shared project folder is your real folder, so git is how you undo what the agent wrote there.

   terminal

   git switch -c agent/overnight
   git add -A && git commit -m "before overnight run"

2. Read the plan. --dry-run prints the folder the agent will see, the hosts it can reach and how the key is handled, and creates nothing. --name and --keep give the sandbox a fixed name and keep it after the agent exits, so you can inspect and rewind it in the morning.

   terminal

   export ANTHROPIC_API_KEY=sk-ant-...
   kosa8 agent run --dry-run --name overnight --keep claude

3. Start the run with limits. Run Claude Code in print mode (-p) in the sandbox, with edits accepted, only the commands you allow, and caps on turns and spend. Everything after claude goes to Claude Code. Run from a script or with nohup, kosa8 streams the agent's output instead of opening a terminal session.

   terminal

   nohup kosa8 agent run --name overnight --keep claude -p \
       --permission-mode acceptEdits --allowedTools "Bash(npm test *)" \
       --max-turns 200 --max-budget-usd 20 \
       "Make the failing tests in ./api pass. Commit to this branch." \
       < /dev/null > overnight.log 2>&1 &

4. Checkpoint while it works. A checkpoint saves the sandbox's memory, processes and disk. One an hour gives you points to step back to; kosa8 keeps ten per sandbox and drops the oldest.

   terminal

   nohup sh -c 'while sleep 3600; do kosa8 checkpoint overnight --label hourly; done' > /dev/null 2>&1 &

5. In the morning, read what happened. List held calls, read the audit log and check it is intact, then read the agent's commits and diff.

   terminal

   kosa8 mcp asks
   kosa8 audit ls -n 200
   kosa8 audit verify
   git log --oneline main..HEAD
   git diff main...HEAD

6. Keep it, rewind it, or throw it away. Rewind the sandbox to a checkpoint to look at an earlier state, reset the branch with git if the work is wrong, and remove the sandbox when you are done.

   terminal

   kosa8 checkpoint ls overnight
   kosa8 rewind overnight --to ID -y
   kosa8 sandbox rm overnight

02What can go wrong when a coding agent runs while you sleep?

Nobody is watching, so one bad step can compound for hours: deleted or rewritten files, a force push, packages installed from a hallucinated name, secrets read from the environment and sent somewhere, or a loop that keeps calling a paid API. The fix is to bound what any step can reach, cap the run, and make the risky steps wait.

Anthropic's documentation says --dangerously-skip-permissions belongs only in isolated environments such as containers or VMs without internet access. A kosa8 sandbox is that kind of environment: its network is closed except for the hosts the kit names, and the model API is reached through a broker that holds the key.

03Why let risky calls wait instead of auto-approving everything?

Because a held call simply does not happen until a person approves it. With the claude kit, kosa8 checks each tool call before it runs: a download piped into a shell is refused, and a force push, a package publish, git reset --hard or a terraform destroy waits in kosa8 mcp asks. The agent is told the call is waiting.

A question waits one hour; after that the agent has to ask again. An approval is good for one use, for ten minutes, and kosa8 mcp approve must be run by a person at a terminal, so an agent cannot approve its own call through a pipe. For overnight runs, that means risky steps are deferred to the morning rather than taken.

If something is clearly going wrong while you are still awake, kosa8 sandbox pause --all freezes every sandbox where it is, memory and files intact, and kosa8 sandbox resume overnight lets it carry on.

04What does a checkpoint undo after an overnight run?

A kosa8 checkpoint restores the sandbox as a whole: memory, running processes and disk, including packages the agent installed and services it started. It does not roll back the project folder shared from your computer, so keep git for that, and it cannot undo anything that already left the machine, such as a request or a push.

Rewinding to an earlier checkpoint drops the later ones, and a rewind cannot itself be undone, so take a checkpoint of the current state first if you might want it back.

05Other options

• Claude Code's built-in sandbox limits where its Bash commands write and which domains they reach, with no extra install; its auto mode reduces prompts.
• A dev container with an egress firewall, which Anthropic documents for Claude Code, fits teams that already use containers.
• Docker Sandboxes runs coding agents in isolated microVM sandboxes from Docker's tooling.
• A full VM in UTM or Lima fits a long-lived machine you manage yourself; snapshots depend on the backend.
• Hosted sandboxes such as E2B, Daytona or Modal fit when background agents should run in the cloud instead of on your computer.

Related guides

• How do I undo what an AI coding agent did?
• How do I require human approval before an AI agent runs a risky command?
• Is it safe to use claude --dangerously-skip-permissions?
• How to stop an AI agent from deleting your files
• How do I try several AI agent approaches in parallel?
• How do I give an AI agent API keys without exposing them?
• How do I restrict an AI agent's network access to an allow-list?