Offboarding AI agents: revoke sessions first, deleting the container isn't enough
ComprehensiveShake76 · reddit · 2026-10-28
A developer running multiple AI agents in per-agent Linux containers on his Mac shares lessons on retiring them: deleting the container or browser profile doesn't kill sessions—copied tokens stay valid until revoked server-side; credentials live for weeks after use stops; read-only filesystems can't stop a signed-in browser acting inside an account.
His rule now: revoke at the service first (sessions, tokens, connected app access), then delete the container, and keep a per-agent list of everything it signed into. Key line: deleting the agent is cleanup; revoking its sessions is offboarding. He admits limits—a container is a strong boundary, not a guarantee, and unseen sessions are still a blind spot.
More from coding & agent
- Matt Pocock mulls banning useState outright in his React apps to steer AI coding agents — mattpocockuk · 2026-10-28
- Developer: tickets, code, tests and PRs should all be generated by agents — intellectronica · 2026-10-28
- Simon Willison: October 2026 is the vibe-coding-games inflection point, Opus 5.5 knows fun — Simon Willison · 2026-10-28
- Avalon-M1 trains LLM agent organisations via collective-reward RL, lifting avg score 33.5% to 45.7% — RobertTLange · 2026-10-28
- Creator chains Halo and Runway via MCP connectors in GPT for a music video workflow — aziz4ai · 2026-10-28
- Dev uses Qwen in an opencode harness to root an LG TV and strip out spyware — Switchboy1 · 2026-10-28