We built our own cloud agents runtime. Here's what we learned

PostHog engineers put a network block that the machine enforces beneath the AI model that screens agent inputs, because that screening AI model can miss what it should catch.

Cleo Lant and Alessandro Pogliaghi write on the blog of PostHog, which makes product analytics and developer tools. They describe the system that runs PostHog's AI agents on cloud machines, including agents that start coding without a person asking. They list the failures that shaped it: lost runs, late messages, unsafe inputs and machines that could not run the company's software.

• One PostHog feature turns errors, support tickets and session recordings into reports, and an agent starts work when a report clears the team's priority threshold.
• These runs number in the thousands each day, and each reads untrusted text from a customer's product while it has access to the code.
• A second AI model screens that text and blocked 1,374 items in one week, but its answers are not predictable, so a network allowlist sits underneath it.
• Each run's state, conversation and files are saved outside the cloud machine, so a new machine can resume the work if the first one fails.

The authors argue that a rule which must always hold needs a block the machine enforces, beneath any AI model that screens inputs. This is a vendor's account of its own product, and the article does not describe who reviews the pull requests that the agents open.

Derived by Working Surface from the article; more in the Playbook. Source line: Nothing that matters lives only in the sandbox.

10 October 2026: as AI agents start work without being asked, the rules that limit them need to be written down and owned: by a person, a team and the machine itself.