A loop is not a prompt. It's everything around the prompt.
The demo is one clever prompt. The thing working my 4am shift is a pile of unglamorous plumbing wrapped around a model I barely think about — a disposable box, a swappable harness, real signals, and one decision no model can make. Here's the whole machine, scars included.
Around 4am, my business did a shift's worth of work. It read the overnight error spike, decided that of the couple hundred new rows exactly one was a real bug, and filed the ticket. It found three Reddit threads where someone had the problem my product solves and drafted a reply for each, parked for my approval. A synthetic user with a backstory and a grudge logged into staging, tried to finish signup, and left me a video of the exact screen where she got stuck.
Headcount: one. I was asleep.
None of that is a prompt. A prompt is the demo that went viral on your timeline — type a sentence, watch an agent build a feature, applause. The demo is a magic trick, and a magic trick needs a magician standing next to it. What ran my 4am shift is a model wrapped in a pile of unglamorous machinery I had to build or buy, and the model is the part I think about least.
The model was never the bottleneck
The comfortable belief is that the gap between that demo and my 4am shift is intelligence. Nail the prompt, or wait one more release, and the thing starts doing your job.
It won't, because the models crossed the good-enough line a while ago. Waiting for the next one is procrastination with a release calendar. A one-shot agent that writes decent code is a party trick; a loop is a party trick you can leave the room during, and the distance between those two is everything around the model. Somewhere to run where it can't hurt anything. A driver that turns text into actions. Something real to react to. And judgement about what's worth doing at all.
You could draw those as a tidy four-box architecture diagram. Every deck does. Don't — it's a lie of tidiness. The pieces aren't equal, and three of them are boring on purpose so the fourth one can be hard.
Somewhere it can't hurt anything
Before an agent works unsupervised, it needs somewhere to work that isn't your laptop, two directories over from your SSH keys. Disposable compute: a box that runs untrusted, model-written code and then stops existing. I use Cloudflare Sandboxes — genuinely a great product — and the shape of every run is the same. A fresh Linux box appears, the agent clones the repo into it and thrashes around with a full shell, and when the run ends the box evaporates with everything it broke inside.
Sounds simple. Here's what the diagram doesn't show you.
For the first while, every deploy of my app killed every agent mid-run. Every deploy. A CSS tweak on the landing page would take down a coding task forty minutes into its work, because the containers were tied to the lifecycle of the app that spawned them, and shipping the app restarted the world. Runs died with nothing wrong in them. The fix — carving the container layer out into its own service that deploys about once a month — is the least tweetable commit in my repo and the single most important one. Later, runs started dying at the build step with a message that just said the sandbox "terminated unexpectedly," and I spent a day suspecting the model before admitting the box was too small: agents don't OOM while thinking, they OOM while running your build.
One rule survived all of it: the API key never enters the box. The container runs code I didn't write and dependencies I didn't vet, so it only ever sees a placeholder; the real credential gets swapped in at the edge, on the way out. Same spot meters every token, which means a runaway loop doesn't drain my account — it gets its card declined mid-swipe and dies politely.
That's what containment buys. Not safety theater — the license to stop watching.
A driver you shouldn't marry
A model produces text. Something has to take the text and act — call the tools, edit the files, run the shell, feed results back, repeat until done. That's the harness, and it's simultaneously the thing people argue about most and the decision that matters least.
I use Claude Code, headless, inside the box. It moves under me between releases. It's opinionated in ways I'd undo if I could, and it hauls around a system prompt I didn't write and can't see the bottom of. It is also, honestly, a great start — tool use, file editing, sessions, all free, saving you the months of plumbing you'd burn before shipping your first loop. If you'd rather own every token that reaches the model, minimal harnesses like Pi exist and people love them. That's a hobby I respect and don't have time for.
Hold it loosely either way. I could swap Claude Code out next month and my loops wouldn't flinch, because the harness is a socket, not the electricity. Falling in love with yours is a way of avoiding the actual work.
Something real to react to
A loop with no signal is a cron job with anxiety: it wakes on a timer, finds nothing real, and invents work — which is how you get an agent confidently "improving" things nobody asked about. The loops that earn their keep don't fire on schedules. They fire on evidence.
Which means collecting evidence is part of the machine. My products carry the 1mn SDK: pageviews, web vitals, in-app feedback, and errors fingerprinted so ten thousand rows collapse into a handful of distinct problems instead of a wall of noise. Around that, the streams a business emits anyway — search queries, revenue, deploys. When a feedback event says checkout is broken on mobile, the resulting task is born with its evidence attached. Nobody wrote a ticket. Nobody had to.
But a firehose is not a to-do list, and this is where most agent setups quietly die. Something has to look at the pile and decide what matters.
The part that's actually hard
This week my dashboard told me I had 175 users.
The real number was about 25. The other 150 were anonymous device fingerprints and bots — 72 of them had visited exactly once. Nothing was broken; every row was technically real. The label was a lie. A threshold rule sitting on that metric would have cheerfully acted on it — celebrated it, reported it, made decisions downstream of it. What caught it was the layer whose whole job is to distrust the signals before acting on them.
That layer is judgement, and it's the piece almost nobody builds, because the temptation is always to fake it with a rule. if errors > 50, file a ticket feels like engineering. It's actually the fastest way to under-build a loop, because judgement is precisely the thing you cannot freeze into an if statement. Mine lives as skills — plain-language briefs the agent reasons through inside the box, weighing evidence roughly the way I would. The dumb heuristics still exist, but as instruments the skill consults, never as the thing making the call.
And judgement cuts the other way too: deciding which signals to ignore. My synthetic users file sharp reports about bugs and missing features, and I throw away everything they say about navigation — an LLM driving a browser doesn't wander, squint, or lose patience like a human, so its "I found this hard to find" is an artifact of the automation, not a fact about the product. Trusting the right senses is a judgement call. So is distrusting them.
Skip this layer and your loop dies one of two deaths: it acts on everything and becomes spam, or acts on nothing and becomes an expensive cron job. Judgement is what earns a loop the right to run unattended, because it's the part that knows when to do nothing. Knowing when to do nothing is most of the job.
The plumbing is mine to give. The judgement is yours.
Put it together and you get the real shape of a loop: evidence trips it, it investigates, it decides, it acts inside a disposable box, it checks its own work, anything irreversible waits at a gate, and the result lands on my desk as a PR, a draft, or a flagged number that turned out to be a lie. The model is one swappable part in the middle — which is exactly why "which model should I use" is the least interesting question in this whole field.
You can build the rest yourself. I did, scar by scar, and you've now read the expensive ones. Or you use the machine I already wired together — that's all 1mn is: the box, the driver, and the wiring, assembled, so the only piece left is the one that was always going to be yours. Because the box is infrastructure and the harness is a commodity and the signals are plumbing, but knowing what your product should do next was never the AI's part.
A loop is not a prompt. It's a model wrapped in plumbing and one hard decision. The plumbing I'll hand you. The decision is the job.
1mn builds the autonomous loops that run a one-person software business — product, marketing, and support — on a schedule. We write about what we learn shipping it.