Two Kinds of Agent Computer: Fly Sprites, Agent City and My Mac Mini

Fly.io published a post this week with a striking line: agents have overtaken humans as its most common customer. It cites Neon too. Agents created 0.1% of new Neon databases in October 2023. Two years later, 80%.

Agents need computers. Two kinds are showing up, and they solve safety in opposite ways.

Kind One: A Cloud Computer per Task

Fly’s answer is Sprites. Each one is a real Linux machine with a 100GB disk that survives sleep, its own HTTPS URL, and a full checkpoint in about a second. It sleeps when idle and wakes on the next request.

A Sprite isn’t a sandbox pretending to be a computer.

— Fly.io

The new part is the path to production. One MCP server lets the agent move from a Sprite to a full Fly app in the same conversation. You approve it in the browser, pick which apps it can see, and there’s “no API token to paste”.

E2B, Daytona, Cloudflare and Modal sell versions of the same idea. The details differ. The safety model doesn’t: every task gets a fresh machine. If the agent wrecks it, you roll back or throw it away.

Kind Two: Your Own Computer, Driven

The other kind runs on the machine you already use. Claude and Codex can both drive Mac apps now. Anthropic’s docs are blunt about it: there is “no sandbox between Claude and your applications.”

My mate Steve built Agent City, a free Mac app (in beta) that runs a team of small agents on your own Mac. Its Computer agent reads apps through macOS accessibility, not screenshots, and it asks first:

• Every action needs a yes. “Every click, field filled in or key pressed shows an Approve / Skip card in the chat first.”
• Silence means no. If nobody answers in ten minutes, the action is skipped.
• Off by default. You turn Computer on yourself.
• Runs on small local models. The default is Qwen 3.5 9B through Ollama, and Qwen 3.5 4B on an 8GB Mac. No cloud account needed. Any Apple silicon Mac will do, and a base Mac mini is plenty.

That’s the right instinct. You can’t give a desktop agent a fresh machine, because the machine’s value is everything already logged in.

My Agent Computer

I have a Mac mini (M4 Pro, 64GB) that runs ushr, my GitHub Actions runner host. This month it became an agent computer too.

The build half was already the cloud kind. Every CI job runs in a throwaway macOS VM. So the host needs no Xcode at all. I deleted it, plus the simulators: 52GB gone, and builds didn’t notice.

The agent half was the hard part. The mini had been a normal Mac before this:

• 46GB of Messages, my photo library, iCloud Drive.
• Teams, Gmail, Slack and WhatsApp, all signed in.
• Various important documents.

An agent driving that Mac can read all of it. I’m not the only one who found this out the hard way. Matt Ronge’s list of six mistakes on his agent Mac mini starts with “Used my personal iCloud account”.

So I cut it back to what the agents need: one Chrome profile for Teams and Gmail, Slack, WhatsApp, Claude, ChatGPT for Codex, Blender, and Docker for running my own projects. The rest went. WhatsApp has no API for personal accounts, so for that one the GUI is the only way in.

What This Doesn’t Solve

• Logins are still blast radius. Fewer accounts means less to lose, not nothing. Every account left signed in is readable.
• Headless means weaker defaults. An unattended agent Mac needs auto-login, which means no FileVault at boot. Anyone with the box gets in.
• Prompt injection is real. Agent City’s docs warn that a web page or message “can try to trick it”. Approval prompts help. Nobody approves a thousand clicks carefully.
• Cloud doesn’t fix this either. Once a Sprite agent gets your API keys, it has the same blast radius as a desktop one.

Closing

In the cloud, the sandbox is the machine. On a desktop, the sandbox is what you leave logged in.

The cloud kind will win for building software. The desktop kind wins for everything without an API: WhatsApp, old web portals, Blender. For those, an agent computer is mostly a cleanup job, and the cleanup is the security.