Computer MCP / Use cases / Unattended runs

Leaving an AI agent running on your Mac overnight

What makes a long unattended run survivable: password fields blacked out before the screenshot is written, dangerous apps that ask every time in every mode, an unanswered dialog that counts as a refusal, and a log you can read back in the morning.

What makes a long run survivable

1. Password fields were never in the picture

The single biggest risk in a long unattended run is not a wrong click. It is that hundreds of screenshots, each one a real picture of a real screen, end up in a model's context and in whatever logs sit behind it. Secure text fields and the windows of listed password managers are painted opaque black on the bitmap while it is still in memory, before any PNG is written. The unredacted image never exists on disk to leak.

The limit, said plainly: only what macOS marks as secure is covered. A password in a text editor or a token in a terminal buffer carries no marking and is not hidden. Before a long run, that is the thing to look at: not whether the tool redacts, but what is sitting visible on your screen that macOS does not consider a secret.

2. The dangerous apps ask every time, no matter the mode

Session consent is a convenience, and convenience is exactly what you do not want on a password manager. Apps on the dangerous list ask on every single action, in every mode, including allow. That is not configurable, deliberately: a setting that could turn it off would eventually be turned off.

And an unanswered dialog is a refusal. If you walk away and the agent hits something that asks, it does not sit there holding your machine hostage and it does not quietly proceed. It gets refused after CMCP_ASK_TIMEOUT seconds, default 60, and the refusal is logged like any other outcome.

3. You can read back the whole run

Every call lands in ~/.local/state/computer-mcp/audit.jsonl, mode 0600, only-grows: the tool, the target app, the outcome, the session. Typed text is a length plus a salted SHA-256 prefix, never the text. computer_audit reads it back, so the first question in the morning, "what did it actually do", has an answer that does not depend on the agent's own account of itself.

Setting up a run you can walk away from

1. Look at your screen first. Close the terminal with the production credentials in the scrollback. Quit the password manager. The redaction handles marked fields; it cannot handle a secret you left sitting in a text window.
2. Pick the mode on purpose. ask with a long CMCP_ASK_TIMEOUT means the run stalls rather than proceeds when it hits something new. allow means it keeps going and you read the log afterwards. Neither is wrong; they fail differently, and you should know which failure you chose.
3. Name the session. CMCP_CLIENT=overnight-export puts a readable mark on every line, which matters if a second agent was also running.
4. Prefer the three background tools. A run built on press, set_value and wait_for does not fight you for the pointer if you come back mid-run, and costs far less than a screenshot loop.

What it does not protect you from

This is the part most pages would leave out. Consent is not containment. Once you have approved the session, the agent is driving your real Mac with your real logged-in sessions. The gate decides whether an action happens; nothing underneath limits what an approved action can reach.

Prompt injection stays possible too. A web page or a document the agent reads can tell it to do something you did not ask for, and the dialogs and the log make that visible rather than impossible. If what you need is a blast radius rather than a record, run the agent against a virtual machine or a second user account, and then the question becomes what it can reach at all, which is a much better question to be able to answer.

When not to use it goes through the rest of that list without softening it.

FAQ

Related