---
title: "Building Agents that Don't Break Themselves"
description: "Agents that call shell commands can damage their host, so the post separates the agent’s durable home from the environment where untrusted code executes. It presents Sprites as disposable, isolated sandboxes, with one Sprite per session for the multi-user SpriteDoc and one persistent Sprite per task for Hermes Agent. SpriteDoc injects each user’s flyctl credential only for the command that needs it, avoiding token storage while preserving the user’s permissions; Hermes can omit approval prompts because the sandbox protects the host. The same separation applies when Hermes itself runs inside a Sprite: its commands are dispatched to another Sprite with a different identity and boot. Copy-on-write checkpoints provide an undo path, restoring deleted files and tools in about nine seconds."
---

# Building Agents that Don't Break Themselves

[Fly.io](https://yomu.fyi/company/fly-io) · Jun 8, 2026

**Type:** Problem & solution

## Summary

Agents that call shell commands can damage their host, so the post separates the agent’s durable home from the environment where untrusted code executes. It presents Sprites as disposable, isolated sandboxes, with one Sprite per session for the multi-user SpriteDoc and one persistent Sprite per task for Hermes Agent. SpriteDoc injects each user’s flyctl credential only for the command that needs it, avoiding token storage while preserving the user’s permissions; Hermes can omit approval prompts because the sandbox protects the host. The same separation applies when Hermes itself runs inside a Sprite: its commands are dispatched to another Sprite with a different identity and boot. Copy-on-write checkpoints provide an undo path, restoring deleted files and tools in about nine seconds.

## Context

Agents need shell access to perform useful work, but model-generated commands can delete files, remove tools, or affect shared infrastructure. Running an agent and its commands in the same environment also creates risks for multi-user systems and the agent’s own host.

## Approach / What changed

Use Sprites as separate execution sandboxes for untrusted commands while allowing the agent process to live in a durable environment. SpriteDoc creates a disposable Sprite per session, Hermes keeps one Sprite per task, credentials are injected only for individual commands, and copy-on-write checkpoints enable rapid restoration.

## Takeaways

- SpriteDoc gives each session its own Sprite, isolating commands from both the agent process and other users; idle Sprites become warm or cold and can later be torn down.
- SpriteDoc injects a user’s flyctl token only for the duration of an authenticated command, so the credential is never stored at rest in the sandbox.
- Hermes can checkpoint a Sprite before risky work and restore it in about nine seconds, recovering deleted files and executables through copy-on-write restoration.

**Tags:** [Security](https://yomu.fyi/topic/security), [Sprites](https://yomu.fyi/topic/sprites)

- Source: [Fly.io](https://fly.io/blog/building-agents-that-dont-break-themselves)
- Source URL: https://fly.io/blog/building-agents-that-dont-break-themselves
- Ingested by Yomu: 2026-09-02T11:58:50.073Z

[Read original post](https://fly.io/blog/building-agents-that-dont-break-themselves)