An always-on agent is a wonderful thing — it codes, triages, and runs jobs while you sleep. It is also a credential sitting in an unattended process for days at a time. The convenience and the risk are the same fact. Here is how to keep the convenience without the 3am surprise.

The shift you're actually making

A chatbot you open and close has a short window to do damage. A 24/7 agent does not. It runs through prompt injections, API outages, budget loops, and your own absence — continuously. So the question stops being "is this prompt safe?" and becomes "what can this process do for the next 72 hours while I'm not watching?"

That answer is decided entirely by the credential it holds, not by the model's good intentions.

The four things that actually matter for an always-on host

  1. Each agent gets its own identity. If a runaway loop or a poisoned web page compromises one agent, you need to cut that one — not take down every agent on the box because they all share a key.
  2. Every credential is scoped. An always-on research agent does not need write access to your repos or spend authority on a metered API. Give it the one capability the job requires.
  3. Revocation is instant and surgical. When you notice something off in the logs at breakfast, you want one action that stops the offender — not an afternoon rotating keys across providers.
  4. There's an audit trail. Unattended means you weren't there. The log is the only way you'll ever know which agent did what.

Notice that none of these are "use a smarter model." They are all properties of the credential, which is the part you actually control.

The setup, step by step

  1. Pick a quiet, low-power host. A Mac mini or a small x86 box is plenty — see our best mini PC for local LLMs guide for the matchups.
  2. Don't paste raw keys into any agent config. The moment a live key lives on disk in a 24/7 process, you've maximized the window for it to leak.
  3. Put a broker between your agents and your real credentials. Connect your accounts once; hand each agent a scoped, revocable key that routes through the broker. The agent never holds the real secret, so it can't leak what it never had.
  4. Set a spend ceiling per agent where the API supports it, so a loop is a capped annoyance, not a bill.
  5. Watch the audit log for the first week. You'll learn what "normal" looks like, which makes "abnormal" obvious later.

Why the broker pattern is the unlock for always-on

Every other approach still ends with a live secret inside a program you're not watching. A local credential broker removes that: the real keys stay in one controlled place, each agent gets its own scoped key, and revoking one agent is a single click that doesn't disturb the others.

Agent Master Key is built for exactly the always-on case: your real API keys and OAuth tokens stay on your own Mac, each agent runs on its own scoped Master Key, and you can revoke any one of them in a click while the rest keep running. Connect once, leave it running, sleep fine.

Bottom line

Running agents 24/7 is not the risk — running them on raw, shared, un-revocable keys is. Give each agent its own scoped key from a local broker, cap its spend, and keep the audit log. Then the only thing your always-on host does overnight is the work you asked for.

If you want a second set of eyes on your setup before you scale it up, our $99 AI Agent Security & Setup Audit reviews exactly this. And if you're still deciding whether to hand agents keys at all, start with is it safe to give AI agents your API keys.