How I Connect My Macs With Tailscale So MyAI Agent Can Work on an Always-On Computer

My AI agent keeps working after I close my laptop. It runs on a second Mac that stays on all day, and I reach that Mac over Tailscale with Screen Sharing and Remote Login. Below are three things the agent got done over that connection, the setup steps for your own machines, and the rules I use so it can't do anything I haven't agreed to.

The three pieces, in plain words

Three free pieces do the job.

Tailscale puts my own devices on a private network. Each Mac gets a name, and only devices signed in to my account can see each other. Nothing is opened to the public internet.

SSH is the standard way for one computer to run commands on another. It has been around for decades. My agent uses it over the Tailscale network, with its own key instead of my password.

Think of it as an intercom that only connects rooms in your own building. A stranger on the street can't press the button.

The third piece is already on every Mac: Screen Sharing. Once Tailscale was in, I started using it all the time. From my laptop I open the always-on Mac's desktop in a window and see what its assistants are doing, without walking over to it.

Win 1: moving my database to the always-on machine

On October 7, I moved OpenBrain, the database that holds my notes and my agents' memory, from my laptop to an older M3 Max MacBook that would stay on around the clock. A Mac Studio has since taken over that job.

My first instinct was to export the database and AirDrop the file. I asked the agent if there was a more secure way.

It used Taildrop, Tailscale's file-sending feature. Taildrop only sends to devices signed in to your own account, so there is no picker to mis-click. The file was 318 MB and arrived in 48 seconds.

Then it did the switch-over from my laptop. My laptop's database was read-only for 2 minutes and 20 seconds. At the switch, both machines held 26,495 documents.

After that, it did something I hadn't asked for. It checked the always-on machine for settings that would quietly take it offline:

• Sleep was on. I turned it off.
• Automatic macOS updates were on. After an update the Mac restarts and waits at the login screen until someone types a password, so every assistant on it would be down until I noticed.
• The machine's Tailscale sign-in was set to expire in April 2027, on a day nobody would be watching. I turned expiry off.

There were also things it would not do. It never typed my passwords. When a command needed administrator rights, it handed the command to me and I typed the password myself. When the Tailscale admin page asked me to sign in, it stopped and let me do it.

One idea there was mine. I wanted to keep the always-on machine's secrets file on my laptop and send it only the one key it needs. The agent made a new AI service key just for that machine, capped its usage at $10 a month, and sent it over SSH without ever printing it.

Win 2: finding why my laptop copy stopped updating

My laptop keeps a copy of that database that refreshes every 15 minutes. On October 30 it stopped refreshing, because the two copies no longer had the same structure.

The agent on my laptop logged in to the always-on Mac and read its database log, which processes had started when, and which files changed during the night.

The cause: the main database's structure had been changed directly, without the written change record we keep for every change. My laptop copy didn't have that change, so it refused to sync.

The agent wrote the missing record. I said yes, and it applied the change to the laptop copy only. It didn't touch the main database. The next refresh ran clean.

Win 3: making sure it's the right machine

On October 31, I started setting up new Grok Bot assistants, AI helpers that work through a list of jobs on their own schedule. Before it creates one, my setup check logs in to the always-on Mac and confirms it is that Mac, by its hardware ID and chip.

That matters more than it sounds. The Mac Studio started as a copy of the old machine, so it answers to the same familiar names. A name alone can't tell you which machine you reached.

The same check confirms my laptop is set so that no assistant can reach its files. The assistants work on one machine, and my laptop stays mine.

How to set it up on your own machines

These steps are for Macs. Tailscale also runs on Windows, Linux, iPhone and Android, so the first three steps work the same there.

1. Install Tailscale on every computer. Download it from Tailscale's website or the Mac App Store. If you use Homebrew: brew install --cask tailscale-app. The Personal plan is free.
2. Approve it. On a Mac, turn on the Tailscale network extension (System Settings > General > Login Items & Extensions > Network Extensions), then click Allow when macOS asks to add a VPN configuration.
3. Sign in with the same account on every machine. Each one then shows up in the Tailscale menu with its own name.
4. On the machine you want to reach, turn on sharing. Open System Settings > General > Sharing. Turn on Screen Sharing to see and use its screen. Turn on Remote Login to run commands on it over SSH. For both, set "Allow access for" to your own user only.
5. Connect with Screen Sharing. Open the Screen Sharing app and type the machine's Tailscale name, or run open vnc://machine-name in Terminal. Log in with that Mac's own user password, and tick "Remember this password in my keychain" so the next connection is one click.
6. Connect with SSH. Run ssh you@machine-name. Then install a key so you, and your agent, never need the password: ssh-copy-id you@machine-name. It asks for the password one time.
7. Keep the always-on machine on. Turn off sleep. On a desktop Mac that's in System Settings > Energy; on a MacBook, sudo pmset -a disablesleep 1. Turn off automatic installs of macOS updates (downloads can stay on). In the Tailscale admin console, open the machine's menu and choose Disable key expiry.
8. Hand your agent the machine. Tell it the machine's name and to connect with ssh -o BatchMode=yes you@machine-name. With that flag, a missing key makes the connection fail right away instead of waiting at a password prompt the agent can't answer.

Other things this setup makes easy

• Scheduled jobs. The always-on machine backs up the database every night, and my laptop pulls a copy each morning. We restored one of those backups as a test, because a backup you have never restored is a hope.
• Names instead of numbers. Tailscale's MagicDNS lets you type a machine's name rather than an IP address.
• Sending files between your own devices with Taildrop. It is still an early test feature, and it only sends to your own devices, not to someone else's.
• Tailscale's own SSH feature, which lets Tailscale handle sign-in. Today it can only receive connections on Linux, or on a Mac running Tailscale's command-line version. I use ordinary SSH keys on my Macs.

Tailscale's free Personal plan covers up to six users, which is plenty for one person with a few machines.

The rules I use

If you run a business and want an agent working on a second computer, these are the rules I'd copy before letting it touch anything.

1. One machine stays on. Sleep off, automatic update installs off, sign-in expiry off.
2. The agent gets its own key. Passwords and administrator rights stay with me.
3. Look before touching. Much of the work in these three wins was reading logs and settings.
4. Check the machine before acting on it. A familiar name is not proof.
5. The main copy changes only on my yes. In Win 2, the fix went to the laptop copy, and the main database stayed as it was.

What would you run on a computer that never sleeps?