In my post on running Claude Code behind the GFW, I ended with a line: “your network is the single most important piece of infrastructure you have.” Here’s a new reason that’s true.

If you run an agent like Codex — the kind that needs to stay online and does heavy web search — and you keep it running for more than 72 hours straight, your home network in China becomes a dangerous place to be. Given enough time, it can start to pick out your VLESS subscription and the traffic behind it.

I won’t pretend I understand the technical side of why. I don’t. But the part I want to stress is simple: running these tasks for a long time is high-risk. The longer one runs, the more your device stands out — until the network stops treating it as ordinary traffic and starts treating it as a target.

If you’re doing this, you may want to borrow what I do now — the MAC approach.

The logic: a network bans your device by its MAC address, the hardware ID every device broadcasts. Once that ID is banned, nothing else you change — node, proxy, subscription — gets you back on. The fix has to happen at that layer.

So I wrote a small LaunchDaemon that does one thing. It watches the WiFi association, and when the device has been fully disassociated for a few minutes — not a transient drop, a real lockout — it forgets the network and rejoins, which forces macOS to regenerate the Private Wi-Fi Address. New MAC, clean reconnect. It’s reactive, never scheduled: idle until you’re actually locked out, a ~30-minute cooldown after each rotation, and jitter on every interval so there’s no fixed cadence.

It’s a stopgap, not a cure — the real answer is a separate line dedicated to the heavy tasks. But it runs itself, and it buys back the 72-hour window.