Sandboxing Patterns for Local AI Agents With Filesystem Access

Short summary

A practical security guide for giving local AI agents filesystem access without catastrophic risk. Covers allowlist-based directory restrictions with path canonicalization, hiding dotfiles and secrets from agent visibility, dry-run write modes that show unified diffs before execution, and kernel-level read-only bind mounts for defense in depth. The author argues the dominant local risk is confident model error, not malice.

• •Use explicit allowlists not denylists for agent filesystem access — canonicalize paths before checking to prevent traversal attacks
• •Hide dotfiles and secret-bearing files from agent reads and writes — an agent reading .env can exfiltrate keys into generated output
• •Dry-run mode showing unified diffs and read-only bind mounts provide defense in depth beyond application-level checks

Generated with AI, which can make mistakes.