Guide

How to reduce what your AI coding agent can access

Published 2026-11-08

AI coding agents are useful because they can run commands on your machine. That same power means they can read files you didn’t mean to share and send data to websites. These steps reduce the risk without making the tools useless.

1. Keep permission prompts on

Claude Code, Codex and Cursor can all ask before running a command. Keep that on, and read the whole command before you approve it, especially anything using curl, wget, ssh, scp, or a script that makes network requests. Look for:

• your email address, name or phone number
• API keys, tokens or passwords
• file contents being sent somewhere

If something looks wrong, deny it and tell the agent why.

2. Don’t use modes that skip confirmation

Each tool has a way to run without asking, for example Claude Code’s --dangerously-skip-permissions flag, Codex’s --dangerously-bypass-approvals-and-sandbox (or --yolo), and Cursor’s Run Everything mode. These modes are meant for disposable environments. On your everyday machine, they remove your last chance to catch a leak.

If you allow some commands to run automatically, keep the list short and leave out anything that can reach the network.

3. Use the tool’s sandbox

Some agents can restrict which files and network hosts their commands can reach:

• Claude Code has a Bash sandbox, off by default. Turn it on with /sandbox. Network access then goes through a proxy that only allows domains you approve, and writes are limited to the project folder (macOS, Linux and WSL2).
• Codex runs local commands in a sandbox that by default has no network access and can only write to your workspace.

Turn these on where available, and leave network access off unless a task needs it.

4. Run the agent in a container or VM

For unfamiliar code, or when you want to let an agent run freely, put it somewhere that doesn’t hold your personal data:

• Dev containers. VS Code and compatible editors can open a project inside a Docker container. The agent sees only the project, not your home folder. Anthropic has a dev container guide for Claude Code.
• A virtual machine or a separate user account for agent work.
• A cloud development environment that you can throw away afterwards.

Don’t mount your home directory, SSH keys or cloud credentials into the container unless the task needs them.

5. Keep personal data out of reach

• Use a GitHub noreply email in your git config.
• Keep secrets in a password manager or secret store, not in plain-text files in your projects.
• Don’t paste personal details into the chat unless the task needs them.

6. Test your setup

Settings are easy to get wrong. Run the Agent Leak Test to see what your agent actually sends to a website that asks for a contact email.