Run an AI coding agent with only the files, credentials, tools, and network access its task needs. Use operating-system or virtual-machine isolation to enforce those limits; do not rely on prompt instructions or approval prompts alone. Keep unrelated secrets outside the agent’s environment, and review its changes before committing or publishing.
What makes an AI coding agent safe to run?
An agent’s effective access comes from the environment in which its code and tools run. OpenAI’s guidance puts it plainly: “Agent-generated code can access the files, credentials, and network available to its environment.” OpenAI’s sandbox security guidance explains why the boundary matters: instructions to the model are not a substitute for limiting what its execution environment can reach.
A meaningful sandbox needs to restrict both filesystem access and network access. Anthropic notes that “effective sandboxing requires both filesystem and network isolation.” The company’s Claude Code sandboxing article describes OS-level controls for paths and domains. A permission prompt can help you oversee a task, but it does not itself create an enforced security boundary.
Set up a safer coding session
- Open only the project the agent needs. Avoid starting in your home directory or a parent folder containing unrelated repositories and personal files. For an unfamiliar repository, use the editor’s restricted or untrusted-workspace mode while you inspect its contents and setup scripts. Visual Studio Code’s secure AI-assisted development guidance explains its workspace trust approach.
- Enable enforced isolation. Choose a feature that restricts access through OS-level controls or a separate VM/container. Check which components are actually covered: a product may treat shell child processes differently from built-in file tools, MCP servers, or language-server connections. A label such as “sandbox” does not guarantee the same boundary across products or surfaces.
- Limit writable paths. Grant write access to the project directory and only the additional locations the task requires. Do not expose SSH keys, browser profiles, cloud configuration, unrelated repositories, or your entire home directory without a specific need.
- Keep network access off or narrow. If the task needs package downloads or a remote API, allow only the destinations required. An allowlist limits where a process can connect, not what it can do at an allowed destination: a permitted host may accept uploads or other changes. Retrieved content can also contain instructions that influence the agent.
- Keep valuable secrets out of reach. Do not put application keys or unrelated third-party credentials in files or environment variables visible to agent-generated code. If access is necessary, prefer short-lived, task-scoped credentials or a trusted broker/proxy that attaches secrets outside the sandbox.
- Review before consequential actions. Inspect the diff and the commands involved before committing, publishing, deleting files, or making external changes. Approval interfaces provide oversight, but command-parsing limitations and broad auto-approval rules make them unsuitable as the primary security control.
- Use a stronger boundary when risk rises. For an untrusted repository, sensitive data, or a task needing broad tools, use a dedicated VM/container or an isolated cloud environment. Check what secrets are mounted, what network is enabled, what data persists after the session, and who can access that environment.
Choose local or cloud execution by its actual boundary
Local execution can be convenient and may use OS-level restrictions without starting a separate VM or container. A cloud environment can separate the agent’s execution from your computer, but its persistence, networking, credential handling, billing, and access controls still need scrutiny. Compare the specific product and surface rather than assuming every “sandbox” means the same thing.
#1 Best Overall
| Check | What to establish |
|---|---|
| Local files and credentials | Which directories, environment variables, credentials, and mounted files can the agent or its generated code read? |
| Enforcement boundary | Are restrictions enforced by OS controls, a VM/container, or only by prompts and application logic? |
| Network | Is access disabled, allowlisted, or unrestricted? Which operations can allowed destinations accept? |
| Tools and processes | Do the restrictions cover shell processes and child processes as well as built-in file tools, MCP servers, and other integrations? |
| Secrets | Are credentials exposed directly, injected for the task, or brokered outside the execution environment? |
| Persistence and operations | What state remains after a session, who can access it, and what costs or setup does the environment require? |
What product documentation says about specific sandboxes
These are product-specific descriptions, not universal defaults. Settings and availability can change, so check the current documentation for the operating system and interface you use.
GitHub Copilot
GitHub’s sandbox documentation says local sandboxing is off by default; before it is enabled, shell commands can run with the user’s account access. It describes local sandboxing as an OS-level restriction rather than a separate VM or container, and cloud sandboxing as a fully isolated, ephemeral Linux environment. The documentation identifies local sandboxing as experimental in Copilot CLI and public preview in the app; those labels and defaults are specific to the documented surfaces and may change.
OpenAI Codex on Windows
OpenAI’s Codex Windows article describes its default mode as reading files broadly, writing within the workspace, and having no internet access unless requested. It also explains that OS restrictions propagate down the command process tree. These details apply to the Windows article’s described configuration; do not assume the same defaults on another Codex platform or version.
Anthropic Claude Code
Anthropic’s sandboxing article describes filesystem and network isolation enforced with OS-level primitives, configurable paths and domains, and a cloud mode with isolated session execution and proxy-mediated Git operations. Check the current product documentation for release status and the controls available in your chosen Claude Code environment.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Rank #3
Can an AI coding agent access your files or leak secrets?
It can access files and credentials exposed to its execution environment, subject to the controls actually enforced there. That is why scope matters: a project-only workspace and limited write paths reduce what the agent can touch, while excluding unrelated credentials reduces what it could expose if a task or tool behaves unexpectedly.
Network restrictions help, but an allowlist is not a guarantee against data exposure. If a permitted service accepts uploads, accessible data could still be sent there; a remote page or repository can also supply content that steers the agent. Use narrow access, avoid placing secrets in reach, and review proposed actions rather than treating any one safeguard as sufficient.
When to use a separate environment
Prefer a dedicated VM/container or isolated cloud workspace when the repository is untrusted, the task handles sensitive information, or the agent needs broader tools or network access than you would grant on your everyday computer. Isolation reduces the impact of mistakes or malicious instructions; it does not make every tool, credential, or permitted network path safe. Before starting, confirm the environment’s mounts, credentials, network policy, persistence, and access controls.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Recommended Free Tools
