Is it safe to run a coding agent on a cloud VM?

The machine runs several tools that each have their own idea of a login — the editor, the file manager, the terminal server. Left to their defaults, that would be several front doors to secure. The model here is the opposite: one front door, and none of the others open at all.

Loopback-bound backends

Each backend binds to loopback with its own login switched off. Nothing on the machine is listening on a public interface waiting for a password to guess. From outside the box, those services are simply not reachable.

One login, at the gateway

The one thing that does face the internet is the HTTPS gateway, and it is the only way in. Authenticate there once and the links on your dashboard need no second password, because the gateway is what makes them reachable at all.

A tool that only listens on localhost cannot be brute-forced from the internet. The smallest attack surface is the one that is not exposed.

SSH is still yours

None of this takes SSH away. Key-based SSH remains available for when you want a plain shell — a deliberate, separate door with its own well-understood lock. We hold a key on the machine too, for re-issuing your dashboard link and for fixes; you can remove it permanently if you would rather we did not.

This article is the shape of the thing. The trust page is the specifics: exactly what a machine reports back to us, how a recycled disk is proven wiped before anyone else touches it, and which certifications we do not have.