Skip to content

Back to the catalog

PrimeIntellect-ai/prime-agent
github.comrepo

PrimeIntellect-ai/prime-agent

Prime Agent is an open source coding and research agent built on a persistent Python REPL and subagent architecture. Its documentation explicitly warns that it executes model generated code with full user permissions and is not a security sandbox, advising users to only run trusted repositories, instructions, and skills.

TL;DR Open source autonomous coding agent that explicitly warns it is not a security sandbox.
Open original ↗
Document

What it is

Prime Agent (PrimeIntellect-ai/prime-agent, MIT-licensed) is an autonomous coding/research agent whose control plane is a persistent Python REPL — the Recursive Language Model (RLM) — paired with a "Continual Harness" of durable, self-refining state. The summary covers the trust model; this adds the concrete install path, the containment/kill controls, and two capabilities that widen blast radius beyond a single session.

How it works

Everything runs as code in the REPL: file ops, shell commands, tool calls, and rlm.spawn(...), which launches real child agents for parallel/background work and returns results programmatically. Two behaviors matter for exposure:

  • Daemon-backed continuity — sessions, REPL state, schedules, and subagents keep running after the terminal detaches, and reattach later. Long-running work is the stated design goal.
  • Direct agent-to-agent communication — running agents and retained subagents discover one another and exchange messages to steer active work without routing through the user.

/refine writes evidence-backed updates to supplemental prompts/memories/skills; it never edits the immutable base prompt, and snapshots allow rollback. Skills are importable Python packages (executable, not just descriptions).

Preconditions / Affected

Runs on macOS/Linux with the user's own permissions in the current directory. The documented install is a pipe-to-shell:

curl --proto '=https' --proto-redir '=https' -fsSL https://app.primeintellect.ai/prime-agent/install.sh | sh

Worker/kernel processes provide lifecycle recovery only — not a security sandbox.

What to do

  • Start it only in a disposable clone, clean worktree, or restorable checkpoint (per the docs).
  • Run untrusted code, instructions, or skills in an external sandbox/restricted environment.
  • Know the control surface for auditing and containment:
prime-agent agents        # list running, idle, saved sessions
prime-agent status        # background service state
prime-agent doctor [--fix]
prime-agent shutdown [--force]   # stop every agent, worker, and background service

Because sessions survive terminal disconnect, a closed terminal does not stop the agent — prime-agent shutdown --force is the actual kill switch. Report vulnerabilities privately via the repo's security policy.

Caveats

Bounded autonomous mode (/autonomous) runs within turn/token/time budgets and user-defined quality gates, but the docs state explicitly: a passed gate verifies only what that gate checks, and hitting a limit does not imply task success. /refine "does not replace packaging and reviewing new executable skills" — review still required for anything executable.

Technologies named here

Related in AI Security