What actually works in my experience: budget the agent a rolling token window per subtask, not per session. If it burns 40% of its context on a single function without a passing test, force an early return with the error context and let the orchestrator decide whether to retry with a different prompt or bail. Putting that logic in the VM host is tempting but wrong — the host doesn't have the semantic context to know "stuck" from "legitimately hard." That belongs in the agent framework or a thin supervisor shim between the framework and the execution environment.

The safer architecture is per-session credential scoping: each agent gets credentials minted for that specific task, revoked on completion. That's what we built Cyqle (https://cyqle.in) around — ephemeral sessions where the encryption key is destroyed on close, so if an agent misbehaves, the blast radius is bounded to that session.

The keychain needs the same isolation principle, but applied at the task boundary, not the agent boundary.

I've been building Cyqle for a while — it's a shared cloud desktop you open in a browser tab and invite people into. Everyone gets their own cursor and keyboard. Think Google Docs, but for an entire Linux machine.

The use cases that surprised me most once people started using it:

- AI agent sandboxing — spin up a disposable desktop, hand it to an agent, let it browse/run/execute freely, close it when done. Zero risk to anything local. The filesystem is encrypted with a session-unique key; when the session closes, the key is destroyed. The data is cryptographically gone, not just deleted.

- Pair programming without the "can you see my screen?" dance — you're both actually in the same environment, not just watching each other.

- Reproducing bugs — "here's the link, you're already inside the same exact environment"

We also just shipped a ready-to-run Picoclaw snapshot — a lighter, less resource-intensive build of OpenClaw with a custom wizard we developed so you can get up and running in a few clicks, no config archaeology required.

Sessions are ephemeral by default. Persistent mode and snapshots available if you need state. Full root, install anything.

Free tier has no credit card. Would love feedback from people building AI workflows — the sandboxing side is where I think there's real untapped potential.

Comments URL: https://news.ycombinator.com/item?id=47316272

Points: 1

# Comments: 0

We built Cyqle (https://cyqle.in) partly around this idea — each session is a full Linux desktop that's cryptographically wiped on close (AES-256 key destroyed, data unrecoverable). Agents can do whatever they want inside, and the blast radius is zero by design. No residual state, no host OS exposure.

The tradeoff is latency and connectivity requirements. For teams already doing cloud-based dev work, it's a natural fit. For local-first workflows where you need offline capability or sub-50ms responsiveness, something like Agent Safehouse makes more sense.

Both approaches are worth having — the threat model differs depending on whether you're more worried about data exfiltration or local system compromise.

Comments URL: https://news.ycombinator.com/item?id=44871530

Points: 3

# Comments: 1