Is it safe to let an AI coding agent run commands on your computer?
Mostly yes, if you keep the default settings and only approve what you understand. AI coding agents like Claude Code, Codex and Cursor ask before risky actions, and some limit what commands can touch. The real risks come from switching those protections off, approving things on autopilot, and giving the agent access to real data. The strongest protection is to let the agent work somewhere separate from your personal files.
What an agent can actually do
A coding agent reads files, writes files and runs commands, the same kind of commands you’d type in a terminal. When it runs a command on your computer, that command has the same access your user account has. If you can delete a folder, so can a command you approved.
That’s what makes agents useful: they can install what a project needs, start it, test it and fix it. It’s also why the defaults matter.
How each tool protects you by default
| What happens by default | The “no brakes” mode | |
|---|---|---|
| Claude Code | Recent versions start in auto mode: a separate safety model reviews actions and blocks the ones it judges unsafe. In manual mode it starts read-only and asks before editing files or running commands. An optional sandbox limits files and network on macOS, Linux and WSL2. | --dangerously-skip-permissions |
| Codex | Runs commands in a sandbox: it can write inside the project folder, network is off, and it asks before going beyond that. | --dangerously-bypass-approvals-and-sandbox (--yolo) |
| Cursor | Auto-review: allowlisted commands run, others run in a sandbox where possible, and a safety check screens the rest. | Run Everything |
One detail worth knowing: Claude Code’s “stay inside the project folder” rule is a permission prompt, not a wall. Its own documentation notes that a shell command you approve can still write anywhere your user account can. A sandbox or a separate machine is what turns that into an actual wall.
What actually goes wrong
1. Approving on autopilot. After the twentieth “Allow?” prompt, people stop reading. That’s when a command that deletes the wrong folder slips through.
2. Turning the brakes off. The modes in the right-hand column above exist for experts running agents in throwaway environments. On your everyday laptop, they remove the main thing standing between a mistake and your files.
3. Real data and real keys. In July 2025, an AI agent on Replit deleted a live production database during a public experiment, despite instructions not to change anything. Replit responded by separating development and production databases. The lesson isn’t “never use agents”. It’s “don’t let an agent near data you can’t afford to lose”.
4. Hidden instructions. An agent that reads a web page, a downloaded project or a document can run into text written to trick it (“ignore your instructions and…”). This is called prompt injection. Anthropic’s own security guidance recommends running scripts and tool calls in a virtual machine, especially when the agent works with outside content.
Six rules if you’re not a developer
- Keep the defaults. Don’t enable “skip permissions”, “yolo” or “run everything” on your personal computer.
- Don’t approve what you don’t understand. Ask: “Explain what this command does and why you need it.” A good agent will explain in plain words.
- Use test keys, never your live ones. Payment keys, production databases and admin passwords don’t belong in a vibe-coding session.
- Give each project its own folder. Never start an agent in your home folder or Documents.
- Make undo possible. Ask the agent to set up git and save progress often (“commit after each working step”). Then any bad change is one sentence away from reversal.
- Separate the agent from your personal stuff. A virtual machine, a separate user account or a cloud workspace means a mistake stays inside that space.
How Eggie handles it
Eggie gives your agent its own small computer: a virtual machine on your computer, separate from your everyday files and programs. Your projects live inside it, your agent works inside it, and if something goes badly wrong, the damage stays there.
We’ll be honest about the limits, as we are on our home page: no wall is perfect, the agent still makes its own choices, and the rules above still apply. Use test keys, and keep an eye on what it does.
You still use the agent you already pay for: Claude Code, Codex or Cursor.
FAQ
Can Claude Code delete my files?
It can run commands that delete files, but by default it either asks you first (manual mode) or a safety check reviews the action (auto mode). The risk goes up sharply if you approve without reading or use --dangerously-skip-permissions.
Does my code get sent to the cloud?
The files stay on your computer, but what the agent reads is sent to the AI provider (Anthropic, OpenAI, or the model Cursor uses) so it can process your request. Don’t keep secrets in files the agent will read.
Is it safe to use --dangerously-skip-permissions?
Only inside an environment you don’t mind losing, like a disposable virtual machine or container. Never on your personal computer with your real files.
Is a virtual machine 100% safe?
No security measure is 100%. A virtual machine makes accidents and most attacks stay contained, which is a big improvement over running everything on your main system. Combine it with the six rules above.
What should I do if the agent did something I didn’t expect?
Stop the session, ask the agent to explain exactly what it ran, and undo with git if you set it up. If it touched accounts or keys, change those passwords and keys.