A Free Host Is Not a Sandbox: Five Agent FAQ Myths

You pointed an agent at a free remote host yesterday. Then you marked the experiment as finished. What did you actually verify on that box?

I keep hearing the same five claims in threads. They sound reasonable after a green CLI exit. They collapse once you add a cheap host audit.

This is a myth-busting FAQ, not a product tour. Each myth gets a claim, a check, and a better model. The checks are labeled proposals, not production war stories.

Why this FAQ exists

Agents assume a lot when the host is "just a demo." Free model access makes retries feel harmless. A free server makes isolation feel already solved.

None of that is true by default. I am not arguing against free endpoints. I am arguing against skipping host-level evidence.

Can you reconstruct the session without trusting the recap? If the answer is no, the demo was theater.

The artifact: a 15-minute host audit

Run this after every agent session on a throwaway box. Treat it as a proposal you can copy. Do not treat the sample output as a benchmark.

Snapshot before the agent starts

# proposal: unexecuted example — adapt paths before you run it
set -euo pipefail
WORKDIR="${WORKDIR:-$HOME/agent-demo}"
STAMP="$(date -u +%Y%m%dT%H%M%SZ)"
AUDIT="/tmp/agent-audit-$STAMP"
mkdir -p "$WORKDIR" "$AUDIT"

find "$WORKDIR" -type f -print0 2>/dev/null | sort -z | xargs -0 sha256sum \
  > "$AUDIT/tree.before" || true
ps -eo pid,ppid,etime,cmd > "$AUDIT/ps.before"
df -k "$WORKDIR" > "$AUDIT/df.before"
(ss -lptn 2>/dev/null || netstat -lptn 2>/dev/null) > "$AUDIT/ss.before" || true

Snapshot after the runner exits

# proposal: after snapshot + diffs
find "$WORKDIR" -type f -print0 2>/dev/null | sort -z | xargs -0 sha256sum \
  > "$AUDIT/tree.after" || true
ps -eo pid,ppid,etime,cmd > "$AUDIT/ps.after"
df -k "$WORKDIR" > "$AUDIT/df.after"
(ss -lptn 2>/dev/null || netstat -lptn 2>/dev/null) > "$AUDIT/ss.after" || true

diff -u "$AUDIT/tree.before" "$AUDIT/tree.after" > "$AUDIT/tree.diff" || true
diff -u "$AUDIT/ps.before" "$AUDIT/ps.after" > "$AUDIT/ps.diff" || true
diff -u "$AUDIT/ss.before" "$AUDIT/ss.after" > "$AUDIT/ss.diff" || true

Score the diffs instead of the recap

# proposal: unexecuted scorer — edit patterns for your shop
from pathlib import Path
import json, re, sys

audit = Path(sys.argv[1])
tree = (audit / "tree.diff").read_text(errors="replace")
ps = (audit / "ps.diff").read_text(errors="replace")
ss = (audit / "ss.diff").read_text(errors="replace")
log_path = audit / "agent.log"
log = log_path.read_text(errors="replace") if log_path.exists() else ""

secretish = re.findall(r"(?i)(api[_-]?key|token|secret|password)\s*[:=]\s*\S+", log)
new_procs = [ln for ln in ps.splitlines() if ln.startswith("+") and not ln.startswith("+++")]
new_socks = [ln for ln in ss.splitlines() if ln.startswith("+") and not ln.startswith("+++")]
new_files = [ln for ln in tree.splitlines() if ln.startswith("+") and not ln.startswith("+++")]

report = {
    "files_changed": len(new_files),
    "secret_shaped_log_hits": len(secretish),
    "new_process_lines": len(new_procs),
    "new_listen_lines": len(new_socks),
}
print(json.dumps(report, indent=2))
fail = report["secret_shaped_log_hits"] > 0 or report["new_listen_lines"] > 0
raise SystemExit(1 if fail else 0)

Four numbers beat a vibes-based recap every time. You can fail a sloppy demo in under a minute. That is the whole point of the FAQ.

I run this shape of audit on throwaway remote boxes. Disclosure: This article was prepared as part of MonkeyCode's product outreach. MonkeyCode offers free model access and a free server option. That pair is enough to exercise the checklist without a GPU rack. It is not a production isolation boundary.

FAQ myth 1: "If the model is free, the loop is free"

The claim people repeat

Free inference means you can retry forever. The only scarce resource is your patience. Why would you cap a loop that costs nothing?

What the evidence actually is

Tokens can be free and still burn wall-clock. Retries still write files, logs, and processes. Your audit directory grows on every "just one more" run.

Ask a sharper question about the loop itself. How many retries did the agent spend on one task? Did the workdir change after the "successful" attempt?

Corrected mental model

Price zero is not the same as budget zero. Cap retries, wall-clock, and files touched. Put those caps in the runner, not the prompt.

# proposal: hard cap the session, not the model bill
timeout 15m your-agent-runner --max-steps 20 --workdir "$WORKDIR"

If the runner cannot accept those flags, wrap it anyway. A free model does not excuse an unbounded outer loop.

FAQ myth 2: "A free server is already a sandbox"

The claim people repeat

Someone else owns the box, so isolation is handled. A shared demo host cannot hurt your laptop. Remote means contained, right?

What the evidence actually is

Remote is not the same as contained. The agent can still leave daemons, cron crumbs, and keys. It can still phone home from that network namespace.

Did you check the process table after exit? Did you check files outside the workdir? Did any new listener appear on the box?

Corrected mental model

Treat a free host as a dirty hotel room. You bring a suitcase. You do not unpack jewelry. Scope credentials to the workdir and one task.

# proposal: refuse to start without a dedicated workdir
if [[ "$WORKDIR" == "$HOME" || "$WORKDIR" == "/" ]]; then
  echo "workdir too broad" >&2
  exit 2
fi

A free server is a convenience. It is not evidence of namespaces, seccomp, or network policy.

FAQ myth 3: "Process exit means the agent stopped"

The claim people repeat

The CLI returned zero, so the agent is done. No foreground process means no leftover work. Why inspect a box that already went quiet?

What the evidence actually is

Exit codes do not inventory child processes. Background installs keep running after the parent dies. Package managers love to detach from the parent shell.

Agents also assume the next tool call is wanted. That assumption survives the parent process. Your ps.diff is where that lie shows up.

Corrected mental model

Stop is a checklist, not a return code. You need process diff, port diff, and file diff. Quiet stdout is not a shutdown proof.

# proposal: fail closed if unexpected listeners appeared
if grep -E '^\+' "$AUDIT/ss.diff" | grep -vE '^\+\+\+' >/dev/null; then
  echo "new listeners after exit" >&2
  cat "$AUDIT/ss.diff"
  exit 1
fi

Who owns those sockets after the runner exits? If you cannot answer, the agent did not stop. It only stopped talking to you.

FAQ myth 4: "Demo secrets on a free host are fine"

The claim people repeat

It is only a short-lived demo key anyway. The host might be gone tomorrow, you hope. Why mint a dedicated credential for a throwaway?

What the evidence actually is

Logs keep secrets longer than the demo lasts. Agents echo environment variables when they "debug." Your audit script should hunt for secret-shaped strings.

A free host is also a shared narrative magnet. People paste recaps. Recaps paste env dumps. That is how a demo key becomes a real incident.

Corrected mental model

If the key can mint anything real, it stays off the box. Use a void credential that fails closed. Prove the leak path with a canary, not optimism.

# proposal: inject a canary that must never appear in logs
export DEMO_CANARY="canary_$(openssl rand -hex 8)"
# after the run:
if grep -R -- "$DEMO_CANARY" "$AUDIT" "$WORKDIR" 2>/dev/null; then
  echo "canary leaked" >&2
  exit 1
fi

No canary in the plan? Then you did not test secret handling. You only hoped the model would be polite.

FAQ myth 5: "The host disk is the session record"

The claim people repeat

Whatever landed on disk is what the agent did. You can reconstruct the session from the workdir. Is that not what a sandbox is for?

What the evidence actually is

Disk misses deleted files, failed fetches, and skipped tools. It also misses prompts that never became writes. A workdir is an effect log, not a decision log.

That is a different lie from treating chat as git status. Here the disk is the false witness. Chat was yesterday's false witness.

Corrected mental model

Keep three artifacts, not one folder. Prompt trace, host audit, and git-tracked diffs. None of those three is optional after a surprise.

Artifact	Question it answers	Lie if used alone
Prompt/tool trace	What was attempted	That the attempt succeeded
Host audit	What leaked or lingered	Why the model chose it
Git diff	What you might merge	What ran at runtime

If one column is empty, you are guessing. Guessing is how demo hosts become folklore.

Decision table: should you even use a free host?

Situation	Use a free host?	Why
Checklist dry-run with void credentials	Yes	You want cheap host evidence
Customer data or production tokens	No	Isolation is not proven
Long-running agents that install packages	Only with a mandatory process audit	Parents exit; children linger
Teaching this FAQ to a teammate	Yes	The myths show up fast

Copy the table into your runner docs. Do not copy my paths blindly. Your workdir conventions will differ.

Limitations

This audit does not replace a container runtime. It does not prove network policy or syscall isolation. It will miss in-memory secrets that never hit disk.

It will miss kernel-level persistence you did not snapshot. It will also miss time-of-check gaps during the run. The scorer only sees before and after.

Who should skip this whole approach today? Anyone shipping a regulated workload on that same box. Anyone who needs attested isolation and signed images. Anyone hoping a FAQ will become a security program.

I will not claim latency numbers or token quotas here. Those change, and I do not have a primary source for them. If a vendor quotes a quota in a dashboard, read that dashboard, not a blog post.

What to copy

Copy the four questions into your runner docs. Ignore my sample paths if they do not fit.

1. How many retries did this session burn?
2. What files and processes changed after exit?
3. Did a canary secret appear in logs?
4. Which of the three artifacts is missing?

If a free remote box is already in reach, run the audit there first. Then decide whether the demo earned a longer leash.