On 29 October, North Korea’s Lazarus Group relieved Binance of $6.3 billion in cryptocurrency in roughly 20 minutes, setting a new world record for the largest heist in human history. According to Binance’s initial security bulletin, the entry point was a classic of the genre: a single compromised laptop belonging to a DevOps engineer, which gave the attackers a path into internal service containers and hot-wallet signing infrastructure.
On that exact same evening, hundreds of thousands of software engineers across the world sat in front of their own company MacBooks, opened a terminal window, and typed claude --dangerously-skip-permissions.
Think about the comedy of that arrangement for a moment. A modern developer’s laptop is the single highest-value target inside any technology company. It holds unlocked SSH keys, cached ~/.aws production credentials, a live Kubernetes configuration, an authenticated Slack session, a browser full of session cookies, and a password manager. Into that room full of crown jewels, we now invite a probabilistic language model, hand it a bash prompt, and instruct it to download arbitrary packages from npm and PyPI, read untrusted repository files, and execute shell scripts until the tests pass.
5 years from now, we will look back on the 2026 habit of running autonomous coding agents directly on a developer’s personal laptop the same way we look back on storing production databases on a tower PC under the receptionist’s desk. We are living through the stone age of local coding agents.
If you examine the 4 dominant terminal coding harnesses in late 2026 (Claude Code, OpenAI’s Codex CLI, OpenCode, and Mario Zechner’s Pi), you can watch the industry slowly discovering that a laptop is the wrong place to run an autonomous worker.
When terminal agents first took off, the default security model was the permission popup. Before the agent ran rm -rf, curl, or npm test, the CLI paused and asked the human to press y.
In theory, this kept a human in the loop. In practice, a coding agent runs 200 shell commands an hour. Within 20 minutes, every developer on earth developed Pavlovian thumb-reflexes, hammering the return key without reading a single character on screen, before eventually giving up and passing --dangerously-skip-permissions or --yolo so they could go and make a cup of tea.
When Mario Zechner built Pi, which passed 115,000 GitHub stars and hit version 1.0 in October, he dispensed with the theatre altogether. As Pi’s security documentation states with refreshing candour, Pi ships with zero permission popups and zero built-in sandboxing, running every bash, read, write, and edit call with the full privileges of the user who launched it. Once you let an agent write and execute code inside your user account, asking for permission on individual commands is like putting a velvet rope across the middle of a swimming pool. OpenCode similarly ships with no operating-system sandbox at all, relying on prompt-level rules until you wrap it in a container yourself.
Anthropic and OpenAI tried to patch the local-laptop problem by bolting operating-system sandboxes onto their CLIs. Codex CLI and Claude Code now wrap shell commands in Apple’s sandbox-exec (Seatbelt) on macOS and bubblewrap plus seccomp on Linux.
Read the fine print in Claude Code’s sandboxing documentation, though, and the limits of local process wrappers become obvious. First, the built-in sandbox only wraps the Bash tool; built-in file tools, MCP servers, and lifecycle hooks still execute directly on your host operating system. Second, if a command fails inside the sandbox or if bubblewrap hits an Ubuntu AppArmor restriction, the harness can fall back to running unsandboxed unless you explicitly lock down the organisation policy. Third, on Linux, namespace sandboxes share the host kernel, and October 2026 alone produced a bumper crop of AI-discovered Linux kernel privilege-escalation and container-escape flaws, from Tencent’s vhost local root bug to pwn.ai’s $700 kernel memory leak and TrendAI’s unpatched ksmbd zero-days.
Even a perfect local directory jail misses the point: in order to do useful work on your laptop, the agent usually needs network access and credentials, which means it is still sharing an environment with your personal machine.
Security is only the first reason local execution is a dead end. The second reason is basic physics: a laptop was designed for one human typing on one keyboard, whereas agentic software engineering is a parallel batch-processing problem.
When you write code by hand, you work on one branch at a time. You edit a file for 10 minutes, run the compiler for 15 seconds, and look at the output. A single M4 MacBook Pro is wildly over-provisioned for one human’s fingers.
Once coding agents actually work, the unit of work shifts from writing a function to supervising a fleet. You don’t want to sit and stare at a single terminal cursor streaming tokens at 80 words a second. You want 8 agents working in parallel: one refactoring the search indexer, one fixing a flaky billing test, one upgrading a database migration, and 5 exploring competing implementations of a new feature.
Try running 10 coding agents in parallel across 10 tmux panes on your laptop (the workflow recommended by Pi’s documentation instead of sub-agents) and watch what happens:
Filesystem and port collisions. Unless you manually provision 10 separate git worktrees and rewrite every configuration file on the fly, all 10 agents immediately stomp on the same working tree, the same
node_modulesfolder, the same local Postgres database, and the samelocalhost:3000dev server port.The spiky compute profile. An agent workload alternates between 2 extremes: 45 seconds of 0% CPU while waiting for a cloud LLM to generate reasoning tokens, followed by a violent 12-second burst where the agent runs
cargo test,pnpm build, and a headless Playwright browser all at once. Multiply that by 10 parallel agents on a laptop and your fan sounds like a Chinook helicopter taking off, your 64 GB of unified memory swaps to disk, and your battery dies before your train reaches Paddington.
A laptop couples permanent local state to fixed, non-elastic compute. That is the exact opposite of what a fleet of coding agents needs.
What a coding agent actually wants is its own disposable computer in the cloud, built on a split between durable storage and transient, elastic compute.
Over the past year, a new infrastructure stack (E2B, Modal Sandboxes, Fly.io Sprites, and Cloudflare Sandboxes) has quietly converged on this exact architecture:
Hardware-isolated microVMs per session. Instead of running inside your laptop’s user account, each agent gets its own dedicated Linux virtual machine with its own kernel, typically booted inside a Firecracker microVM (E2B and Fly Sprites) or a full VM sandbox (which Modal made generally available on 1 October and which now powers every Linear Coding Session). Inside that microVM, the agent has full root access, its own Docker daemon, its own
localhost:3000, and its own Postgres instance. If a malicious npm package executesrm -rf /or dumps/proc/self/environ, it destroys an empty box that contains zero production credentials.Brokered secrets outside the box. In Claude Code’s new cloud sessions, Cloudflare Sandboxes, and E2B’s network proxy, the API keys and GitHub tokens never live inside the sandbox’s environment variables or filesystem. The agent inside the VM only sees a dummy placeholder; an external proxy inspects outbound HTTP requests against a domain allowlist and injects the real credential on the wire. Even if the agent is completely hijacked by prompt injection, it cannot steal a key it never held.
Semi-ephemeral persistence (snapshots and network volumes). Spinning up a fresh container is useless if the agent has to spend 6 minutes running
apt-getand compiling dependencies on every turn. The new cloud sandboxes solve this by separating the compute lifecycle from the disk lifecycle. Modal mounts persistent network volumes and takes filesystem and memory snapshots; Fly Sprites attach a persistent 100 GB ext4 disk to a Firecracker microVM that automatically sleeps when the agent goes quiet and wakes in 100 milliseconds; E2B snapshots both the filesystem and live RAM, pausing the microVM indefinitely for $0 while the agent waits on human input and resuming in 80 milliseconds with running processes intact. Need to test 10 different approaches to a bug? Fork the VM snapshot 10 times in under a second, let 10 agents burst to 32 vCPUs each for 15 seconds, keep the winner, and throw the other 9 away.
The biggest shift when agents move off the laptop is how human beings actually supervise the work.
When an agent is running locally in a terminal window on your MacBook, the agent is chained to the physical lid of your computer. If you kick off a 20-minute refactoring job and shut your laptop to walk to a meeting, catch a flight, or go for dinner, the TCP connection drops, the process suspends, and the work stops dead.
Once the agent lives in a semi-ephemeral cloud VM with durable state, the session can outlive your laptop. You can dispatch 6 tasks from your desk at 5:30pm, shut your laptop lid, and walk out of the building. While you are on the Tube, 4 of those agents finish their pull requests, and 2 of them hit an ambiguous product decision and pause their microVMs at zero compute cost. You pull your phone out of your pocket, inspect the diff or the live preview URL coming out of the sandbox, tap an approval card or dictate a 2-sentence steer, and the microVM wakes up and finishes the job before you get home.
Both OpenAI’s Codex Cloud and Anthropic’s claude --cloud / --teleport are early steps toward this model, and the standalone infrastructure layer (Modal, which crossed 3 billion sandbox runs in October, alongside E2B and Fly) is already building the plumbing for everyone else. Running an autonomous software engineer inside your personal laptop’s shell was a fun hack for 2026. The future of coding is a fleet of disposable cloud computers with persistent disks, brokered keys, and a supervisor steering them from a phone.