Agent brains vs hands — separate the loop from the shell

An agent is a loop: call model → pick tool → repeat. That loop wants memory and a stable home. The hands — bash -c on model-produced strings — want a blast radius of zero.

Failure mode

Put both in one box. “Delete temp files” becomes rm -rf of the toolchain. Multi-user agents share one filesystem. Tokens sit on disk “for convenience.”

Better shape

• Brain: long-lived process (machine, small VMS, laptop) — no need for a fortress.
• Hands: one disposable sandbox per session or task; tear down when idle.
• Credentials: inject for a single command; never write the user token into the sandbox image.
• Undo: checkpoint before risky steps; restore beats “restore from backup if you have one.”

If the agent already lives in a sandbox, still run untrusted commands in a different one. Home can be comfortable; execution should be set-on-fire cheap.

Pattern discussion (Sprites / session sandboxes): Building Agents that Don't Break Themselves.