How do I prove agents cannot escape?

Run `fleet doctor`, then `go test -count=1 -run TestAcceptance_CompromisedAgentHasNoAlternateEgressPath ./internal/sandbox/`. A passing run prints TCP_DENIED and SECRET_DENIED. Details: https://fleetctl.ai/security/#containment. https://fleetctl.ai/sandbox/ is not the jail.

Does my source code leave my infrastructure?

Only to the model backend you chose and GitHub. Your source never goes to Fleet. A registered instance reports operational metadata and one billing fact per durably authorized hosted root-workflow start, not your source.

Can an agent approve its own network access?

No. Workload, MCP, and in-sandbox callers are refused. A human grant enables a specific host or SNI for a bounded window. That grant is not a merge permission.

Does the Fleet CLI send usage analytics?

Yes, anonymous and opt-out: command names, version, OS — never code, paths, argument values, or repo names. Disable with `fleet config set telemetry off`, `FLEET_TELEMETRY=0`, or `DO_NOT_TRACK=1`.

How to Secure AI Agents Running in Your Codebase

Name: Fleetctl
Brand: Fleetctl
Author: Fleetctl

Letting AI agents write, review, and merge code is a security decision. The first question is whether the process can escape: open sockets, read host secrets, hit cloud metadata, or follow a workspace symlink onto the machine. The second is where your source goes.

Fleet starts each Fleet-launched agent in a Linux jail: user, mount, PID, and network namespaces, default-deny networking, and a host inference broker that owns model keys. A grant names a host, such as registry.npmjs.org, for a bounded window. Merge and delete stay on your review and approval steps. Prove the jail with fleet doctor and TestAcceptance_CompromisedAgentHasNoAlternateEgressPath. This guide walks through that proof, then the layers that sit on top of it.

Before you start

A Linux host that can create user, mount, PID, and network namespaces
Fleet installed from `curl -fsSL https://fleetctl.ai/install | sh`
Claude Code or OpenCode installed and authenticated
The Fleet source checkout if you want to run the public oracle test
A GitHub repository and the `gh` CLI, or a GitHub App you can install

Prove the jail before you grant the network

On the Linux host that will launch agents, run fleet doctor. Then from the Fleet repository run go test -count=1 -run TestAcceptance_CompromisedAgentHasNoAlternateEgressPath ./internal/sandbox/. A passing transcript prints TCP_DENIED, SECRET_DENIED, and the rest of the DENIED lines. If the process needs a host, the run parks until you allow that host. The write-up lives at https://fleetctl.ai/security/#containment.

fleet doctor
# agent sandbox: user+mount+pid+net namespaces available

go test -count=1 -run TestAcceptance_CompromisedAgentHasNoAlternateEgressPath ./internal/sandbox/

Name the real trust boundary

The binary runs on your machine, stores state in ~/.fleet/fleet.db, and never receives your source. Outbound paths you should name: the jail's default-deny network; the host inference broker (model keys stay on the host); destination grants a human approves; the CLI's opt-out usage analytics; a registered instance's operational metadata plus one billing fact per durably authorized hosted root-workflow start; GitHub via gh. Source goes only to the model backend you chose and GitHub. Fleet does not jail Grok Bot, Cursor Cloud, or Codex cloud VMs.

# Stays on the host:
#   Fleet binary, jail, inference broker, ~/.fleet/fleet.db
#   source code never goes to Fleet
# Leaves only through named paths:
#   granted host/SNI after a human approve
#   model backend (Anthropic, or Bedrock/Vertex in your cloud)
#   GitHub API via gh
#   opt-out CLI analytics (command names, version, OS — never code)
#   control plane metadata, only if registered

Keep egress destination-level and human-approved

v1 authorizes connectivity to a host or SNI for a bounded window. It does not authorize merge or delete. An unknown destination parks blocked_on_egress without holding a socket. Workload, MCP, and in-sandbox callers cannot approve. Fling is notification, not authorization. When a grant expires or is revoked, tracked relays close.

# Contract the oracle encodes:
#   cannot escape → can request → workload cannot self-approve
#   → human grant enables that destination → failures fail closed

Put irreversible workflow steps behind a human

Containment limits where the process can talk. Governance still has to stop a merge you did not want. Put human sign-off on the workflow steps that change git history or production, and keep house rules pinned for the run so a mid-run edit cannot loosen them.

# In the saved workflow: review and approval steps before merge.
# A single-operator setup can keep one human able to approve egress;
# separation of duties is a Business/Enterprise control.

Run the brain so the risk model can quarantine

Fleet's risk model is a logistic-regression over operational signals. It is not the 6-dimension quality evaluation. When risk reaches critical, the brain quarantines the agent: the session stops and does not auto-restart. Quarantine only works if the brain is running.

fleet brain start
fleet brain insights

Give agents least-privilege GitHub access and read the log

Prefer a GitHub App with contents, pull requests, and issues — not a personal token with your full account. Set use_github_app on the agent. Review fleet log after any quarantine before you restart that agent. Isolate developer worktrees and set a run-time duration budget so a looping session dies instead of running for hours.

agents:
  - name: backend-dev
    role: backend-developer
    department: engineering
    reports_to: tech-lead
    use_github_app: true
    max_concurrent: 1

fleet log --agent backend-dev --since 7d

Common pitfalls

Do not cite https://fleetctl.ai/sandbox/ as the jail. That route is a canned Refine → Develop demo. The oracle is `TestAcceptance_CompromisedAgentHasNoAlternateEgressPath`.
The jail is Linux-only. It does not sandbox Grok Bot, Cursor Cloud, or Codex cloud VMs. Destination-level grants are not action-level policy.
Fleet is local-first — your source never goes to Fleet — but it is not a zero-egress air-gap. Agents need a model backend. A registered instance reports operational metadata. Disable CLI analytics with `fleet config set telemetry off`, `FLEET_TELEMETRY=0`, or `DO_NOT_TRACK=1` if policy requires it.
Quarantine only works if `fleet brain start` is running. Approval steps only work if the workflow actually includes them.
Authenticating every agent under a broad personal access token gives them your full GitHub account. Prefer a GitHub App.

When Fleet is the right tool

Fleet is the right choice when you need a jail around locally running agents that you can prove, plus governed workflows on infrastructure you control. It is not the right choice if you need Fleet to sandbox a vendor cloud VM, or if your policy forbids any outbound connection at all.