Leaving an AI agent running on your Mac overnight

What makes a long run survivable

1. Password fields were never in the picture

The single biggest risk in a long unattended run is not a wrong click. It is that hundreds of screenshots, each one a real picture of a real screen, end up in a model's context and in whatever logs sit behind it. Secure text fields and the windows of listed password managers are painted opaque black on the bitmap while it is still in memory, before any PNG is written. The unredacted image never exists on disk to leak.

The limit, said plainly: only what macOS marks as secure is covered. A password in a text editor or a token in a terminal buffer carries no marking and is not hidden. Before a long run, that is the thing to look at: not whether the tool redacts, but what is sitting visible on your screen that macOS does not consider a secret.

2. Password managers are never driven from the background

Session consent is a convenience, and convenience is exactly what you do not want on a password manager. In background mode (the default) an action in a password manager is refused and can never be approved from the menu bar; in the foreground (while an agent has the screen, or with CMCP_BACKGROUND=0) it asks on every single action, including in allow. That is not configurable, deliberately: a setting that could turn it off would eventually be turned off. Terminals and editors, where a keystroke can be a command, ask once per app per session.

And an unanswered question is never a yes. If you walk away and the agent hits something that asks, it does not sit there holding your machine hostage and it does not quietly proceed. The question waits in the menu bar icon for about ten minutes and then expires with nothing done. A dialog appears only in the foreground, for a question the icon may never approve or when the icon is not running, and is refused after CMCP_ASK_TIMEOUT seconds, default 60. The log shows the call as waiting in the first case and as denied in the second.

3. You can read back the whole run

Every call lands in ~/.local/state/computer-mcp/audit.jsonl, mode 0600, only-grows: the tool, the target app, the outcome, the session. Typed text is a length plus a salted SHA-256 prefix, never the text. computer_audit reads it back, so the first question in the morning, "what did it actually do", has an answer that does not depend on the agent's own account of itself.

Setting up a run you can walk away from

1. Look at your screen first. Close the terminal with the production credentials in the scrollback. Quit the password manager. The redaction handles marked fields; it cannot handle a secret you left sitting in a text window.
2. Pick the mode on purpose. allow is the default: it keeps going and you read the log afterwards; terminals and editors (once per session), quitting and closing still ask, and password managers are refused. ask adds one question before the first write, which then grants the session - so an unattended run in ask mode stalls at its first write until you answer. Neither is wrong; they fail differently, and you should know which failure you chose.
3. Name the session. CMCP_CLIENT=overnight-export puts a readable mark on every line, which matters if a second agent was also running.
4. Prefer the three background tools. A run built on press, set_value and wait_for does not fight you for the pointer if you come back mid-run, and costs far less than a screenshot loop.

What it does not protect you from

This is the part most pages would leave out. Consent is not containment. Once you have approved the session, the agent is driving your real Mac with your real logged-in sessions. The gate decides whether an action happens; nothing underneath limits what an approved action can reach.

Prompt injection stays possible too. A web page or a document the agent reads can tell it to do something you did not ask for, and the dialogs and the log make that visible rather than impossible. If what you need is a blast radius rather than a record, run the agent against a virtual machine or a second user account, and then the question becomes what it can reach at all, which is a much better question to be able to answer.

When not to use it goes through the rest of that list without softening it.

FAQ

Related