Straight answers about running AI coding agents

How do you keep a coding agent running after you close your laptop?

Move the agent off the thing that sleeps. A detached session survives a disconnect; only another machine survives a lid close.

Run the agent somewhere that does not sleep. A terminal multiplexer such as tmux keeps it alive when your SSH connection drops, but not when the machine itself suspends. To survive closing a laptop the agent has to be on a machine that stays awake: a desktop, a home server, a VPS, or a hosted service. Everything else is a workaround.

How do you give an AI agent database or API access without leaking credentials?

Keep the secret out of the conversation. The agent should operate a tool that holds the credential, never read the credential itself.

Keep the credential out of the model's context. The agent should run a tool that already holds the secret, rather than being told the secret and asked to use it. That means environment variables or a secret store the process reads, scoped credentials with the narrowest rights the job needs, and separate keys per task so one mistake does not expose everything.

How do you review code an AI agent wrote before it lands?

Read the diff, not the summary. Make the agent's work land somewhere that requires a decision to merge.

Make the agent's work land somewhere that cannot merge itself, then read the diff rather than the agent's description of it. In practice that means a branch per agent, a review of every hunk before merge, and tests that run on the branch. The summary an agent writes is a claim about the change, and the diff is the change.

Where does your code go when you use a cloud coding agent?

Two questions decide it: whose machine holds the checkout, and whose account holds the keys.

It depends on where the agent runs, and there are two separate questions. First, whose machine holds the checkout while the agent works. Second, whose account holds the credentials it uses. A cloud agent service clones your repository onto its infrastructure and holds tokens on your behalf. A locally run agent keeps both on your machine and sends only the text of the conversation to the model provider.