Profiles / unreallabsai
Unreal Agent
The thinnest harness on the watchlist: three tools, idempotent inputs and forkable sessions, with a system prompt that promises a sandbox the runner does not enforce.
Operator Stance / as of 2026-09-23
- Use it for
- Builders who want a small, durable agent loop to put their own sandbox and policy around: inputs are deduplicated by caller ID, sessions are append-only and forkable, and tool work is a serializable operation that can run in a remote box.
- Avoid it for
- Running it directly on a workstation. The default system prompt tells the model it is in an isolated container, and nothing in the runner checks that it is. There is also no approval step in the library.
- Watch next
- Whether a release adds a container check or an approval seam; published benchmark results with a method; whether the vendor claims the look-alike Docker Hub namespace.
Unreal Agent is on the watchlist as the purest bet on a thin harness. It arrived the week a study found that swapping harnesses moves cost far more than it moves success. The design reads like an answer to that: almost nothing between the model and the work, and the engineering spent on durability instead.
Where it stands, 2026-09-23
Channel. Two releases, both on 22 September:
v0.1.0 and
v0.1.1,
neither a prerelease. It installs with go install or as a Docker image. The
repository says it carries
selected components from a larger internal codebase
and does not merge outside pull requests, so a quiet public history is not
evidence of quiet work.
What it is. Three tools: Bash, ViewImage and skill use. Around them, an inbox that drops repeated inputs by a caller-supplied ID, an append-only session store that can fork, tool translators that do no I/O, and versioned, serializable operations run by a swappable operation manager. The README gives the intended extension: a proxy manager that ships operations to a process inside a remote sandbox.
The async claim, read in code. The pitch on X is that its async tool design saves tokens. The mechanism is real at v0.1.1. A tool call becomes an operation that runs on its own. If the model is called while one is still going, the Bash tool answers “Command is still running.” instead of blocking. While the loop is waiting only on tools, the coordinator does not call the model at all. It waits for operation updates or new input, and sends the model one heartbeat after ten minutes by default. That is the opposite of a harness that re-sends the whole conversation to poll a background job. It is a plausible saving. It is not a measured one: no benchmark results are published, and none of the token figures in circulation come with a method.
The prompt promises a box the runner does not build. At v0.1.1 the default system prompt begins “You are an AI agent running inside an isolated sandbox container.” The runner’s first example runs it in your current directory. There is no approval step in the library. Run the Docker image with a mounted workspace, the one setup where the prompt is true, or put your own sandbox around it.
Mind the image name. The
release workflow
publishes to unrea1labs/unreal-agent, with a digit one. The look-alike
unreallabs namespace was unclaimed on 23 September. Copy the name from the
README; do not type it from memory.
It can borrow a ChatGPT login. The openai-codex provider reads a ChatGPT
subscription token from the
Codex auth file
and does not refresh it. A long run ends when the token expires.
What is unresolved
- Whether any release adds a check that refuses to run outside a container.
- Which internal components are withheld, and whether a policy or approval layer is among them.
- Benchmark results. A Harbor evaluation adapter is published; scores are not.
Verification
open source commits / evidence floor: official docs / updated 2026-09-23
Source policy: what Frontier watches and accepts as evidence
Edited and maintained by Bitter Frontier.