Agent Autoloop: A Self-Hosted Hub That Lets Claude Code and Codex Work in the Background

Agent Autoloop is a self-hosted hub that starts command-line coding agents from events and only interrupts you when a decision is needed. The GitHub project, KKKKhazix/agent-autoloop, showed about 2,300 stars, 462 forks and an MIT license when we read it on November 4, 2026. It was trending as a new AI repository, with the stars arriving since November 3.

The pitch in its README is that agents should "take on work in the background and follow it through to the end." That sentence is our translation of the Chinese original, and the project documentation is mostly in Chinese. It sits in a growing group of tools that wrap Claude Code and Codex in a scheduler, an inbox and a permission layer, instead of leaving you to babysit a terminal.

TL;DR: what you need to know

Agents that act on your behalf need rules. See how explainx helps secure your agents →

How does Agent Autoloop work?

The README describes a five-step loop. An event arrives. A rules file at ~/.agent-autoloop/rules.json decides which agent runs and in which directory. The agent finishes one round, writes its result into its final reply, and exits. If a risky action needs a human, the agent asks through a card. After you answer, the hub resumes the original session.

The design choice that matters is the exit. The agent does not sit in a process waiting for you. According to the README, waiting costs no process and no tokens, because the session is simply resumed later. That is different from a long-running agent that holds a terminal open for hours.

The README also states the core has zero external dependencies, which keeps the install small and the audit surface short.

The commands you will use

These come straight from the README:

curl -fsSL https://raw.githubusercontent.com/KKKKhazix/agent-autoloop/main/install.sh | sh
agent-autoloop try
agent-autoloop status
agent-autoloop check
agent-autoloop why 1
agent-autoloop answer 1 <number>

try runs a demo. status shows the hub. check validates your rules file. why 1 traces what happened in run 1. answer 1 <number> replies to card 1 with an option number from your terminal.

Piping a script from the internet into sh is a trust decision. Open the script first, and run it on a machine or account you can afford to reset.

What can trigger an agent?

A box passing from one tray to another, picturing events handed to a background coding agent

The README lists three kinds of events: scheduled cron jobs, new GitHub issues, and HTTP calls. It ships example recipes for a morning brief, GitHub issue follow-up, operations alerts, website monitoring and a pull-request delivery pipeline. Plugin templates let you add your own sources.

The delivery pipeline is the most powerful and the most sensitive recipe. The README says it can review, merge and deploy pull requests. Its security page says delivery accepts only branches from the repository named in the rule into main, and that pull-request code, tests, configs and hooks are never checked out or run on the worker machine. Project settings, review requirements and review commands are read from main, not from the branch under review.

That is a sensible boundary. It still means an agent can approve and ship code on your behalf, so test it on a throwaway repository first.

Which agents and channels does it support?

The author tested Claude Code, Codex and an Agent Client Protocol adapter. The Agent Client Protocol is an open standard for connecting editors and tools to coding agents. The README also lists other CLIs, among them DeepSeek Harness, pi, OpenClaw, Hermes, Cursor and CodeBuddy, but says the authors have not run those one by one. Read that as "a command template exists," not "supported."

For notifications, desktop alerts are the default. Feishu is the main chat channel. DingTalk, WeCom, Slack and Discord work through webhook templates, which the README says were tested only against a local mock service. In other words, the approval card works on your desktop first, and the chat integrations deserve your own testing.

What are the security boundaries?

A mechanical gripper handing a bead to a human hand, showing how Agent Autoloop asks for approval before risky actions

The project publishes a SECURITY.md. These are the points worth knowing before you run anything unattended.

• Rules decide everything. Only rules.json chooses the assignee, the working directory, the skills and the permissions. Events cannot pick plugins, repositories, commands or permissions.
• The default permission is edit. The page says granting full means thinking about everything the agent can reach, and that side-effecting actions should use askFirst.
• Prompt injection is not solved. Titles and bodies written by other people, such as a GitHub issue, are placed in files labeled as data instead of in the prompt. The page says plainly that this does not block all prompt injection.
• Read access still reads secrets. The page warns that a read permission does not stop an agent from reading secrets on the machine. It suggests a separate system account or a container.
• The hub listens on localhost. For outside access, put an HTTPS reverse proxy in front.
• Approval links are bearer links. Card links last seven days, and anyone holding one can answer that card. Do not post them publicly.
• Credentials stay with the agent CLI. The hub launches your already logged-in tools and says it does not handle or store their credentials. Access keys are stored as SHA-256 hashes.
• Webhook authentication is not described. The security page does not describe signature checks for incoming webhooks, so put your own authentication in front of any public endpoint.

The same page lists known limits: crash-safety tests cover process kills and a finite set of scenarios, not a power-loss proof, and it is not a full security audit. ACP authorization depends on the agent honoring the protocol.

We have tracked what goes wrong when agents get broad access. A Railway engineer reported AI agents port-scanning and requesting secrets, and GitBook disclosed an incident where attackers used AI agents and stolen API tokens. Another case is Postman Desktop auto-installing coding-agent plugins. An unattended hub is exactly the setting where such mistakes happen without anyone watching.

What is still unverified?

The README is unusually honest about its test coverage, and that is the most useful part for deciding whether to adopt it.

• GitLab webhooks were tested against documented formats, not a real GitLab instance.
• The Feishu recipe was tested with a fake CLI.
• Slack, Discord, DingTalk and WeCom were tested against a local mock.
• Text channels need hub.publicUrl set to an address your phone or computer can actually reach.
• Windows has no support yet. The author promises a version after November 7 and 8.
• The repository showed only a handful of open issues and pull requests at capture, so the issue tracker has little history yet.

The star count tells you about interest, not reliability. A repository that gained thousands of stars in a day has not yet been through weeks of real use.

How does it compare with other agent tools?

Agent Autoloop is a trigger-and-approval layer. It does not manage branches, and it is not a sandbox. That puts it next to, not against, several tools we have covered:

• Worktrunk gives each parallel agent its own Git worktree. You could point an Autoloop rule at a worktree directory.
• Orca is an orchestrator with a GUI and mobile view for many agents.
• Agentplane is a local control plane for running Claude Code, Codex and Cursor side by side.
• Octomind is a Rust agent runtime with guardrails defined in TOML.

If you want agents that run on a schedule and reply to issues, Autoloop is the closest to that job. If you want isolation, pair it with a container or a separate account, as its own security page suggests.

How to try it safely

1. Read install.sh before running it.
2. Create a separate system account, or use a container, with no access to your personal secrets.
3. Run agent-autoloop try, then agent-autoloop check against a minimal rules.json.
4. Start with one cron rule that only reads and summarizes, such as the morning brief recipe.
5. Keep the permission at the default edit or lower, and use askFirst for anything that sends, merges, deploys or deletes.
6. Do not expose the hub to the internet until you have an HTTPS proxy with its own authentication.
7. Use API keys for frequent runs. The README says personal subscription quotas are a poor fit for high-frequency automation, and the project is not affiliated with Anthropic or OpenAI.

For teams, a policy layer that watches what agents actually do is the next step. AgentBeam is the agent security platform from the explainx.ai team, built to stop AI agents before they take dangerous actions.

What this means for what you build or pay

For builders, the lesson is the architecture. One round per event, then exit, then resume after approval, avoids paying for idle waiting and makes each run easy to trace with why. You can copy that pattern even if you never install this repository.

On cost, remember that each background run is a real agent session. A cron job that runs every ten minutes can drain a subscription quota. Set a schedule you can defend, and watch usage for the first week.

On risk, treat every event source as untrusted input. A public GitHub issue is text written by a stranger that your agent will read. The project's own warning about prompt injection applies to every rule you write.

What to watch next

Three things will show whether this project lasts: a Windows build, real-world reports for the chat channels that are currently mock-tested, and a security review beyond the author's own page. Check the repository's issues and releases before you depend on it.

Related reading

• Worktrunk: a Git worktree CLI for parallel AI coding agents
• Claude Code Desktop parallel sessions and worktrees
• Orca, an open-source agent orchestrator
• Agentplane, a local control plane for coding agents
• Octomind, a Rust coding-agent runtime with guardrails
• Railway engineer: AI agents port scan and secrets request
• Agent Autoloop repository and Model Context Protocol

Details are accurate as of November 4, 2026. Star counts, issue counts and README claims come from the repository on that date and can change.