---
title: "Letting an AI Agent Run Commands on Your Machine or Server: How to Stay Safe"
url: https://phatdev.net/en/blog/ai-agent-safety-on-your-machine
lang: en
updated: 2026-10-21
alternate:
  vi: https://phatdev.net/vi/blog/ai-agent-safety-on-your-machine
markdown: https://phatdev.net/en/blog/ai-agent-safety-on-your-machine.md
---

# Letting an AI Agent Run Commands on Your Machine or Server: How to Stay Safe

> Seven steps for letting an AI agent run commands without risking your data: least privilege, sandbox, ask-first modes, no passwords, a separate git branch, backups and reading each command before approving.

Categories: AI | Published: 2026-10-21 | Level: Intermediate | 6 min read

Tags: ai-agent, sandbox, permissions, claude-code, codex, antigravity, git

You let an AI agent run commands so it can clean the build folder for you. It types a delete command with a wildcard, the path is slightly off, and your product images folder vanishes along with it. Nobody meant harm. A machine simply did exactly what the words said, in a room with too many doors open.

An AI agent (an AI tool that does more than answer: it reads files, edits files and runs commands) is useful precisely because it has hands. That is also why you build fences before you let it work. This post explains how, in plain words, with quotes from the official docs of Claude Code, Codex CLI and Google's command-line tools. I checked those pages on 21 October 2026. Mode names and settings may change between versions.

## 1. Give it the least access that works

The old security rule: grant only what the current job needs. For an agent, the first step is to run it as an ordinary user, not as the administrator (root), and open only the project folder.

Claude Code has a step-by-step mode called Manual: it can only read, and it asks before editing files, running commands or touching the network. You can also forbid things outright with `deny` rules, such as reading your `.env` file or running `git push`.

One detail people misread: according to the docs, Claude Code's "stay inside the project folder" boundary is a permission question, not a wall. A Bash command you approved can still write anywhere your user account can. For a real wall, you need a sandbox.

## 2. Use a sandbox

A sandbox is a box the operating system builds around the agent's commands: they can only touch the folders and network addresses you allow. Inside the box the agent can run without asking you about every command, because a bad command cannot leave the box.

In Claude Code the sandbox is off by default. You turn it on with `/sandbox`. When on, commands can write only to the working folder and a temp folder, and network traffic goes through a checkpoint whose allowed-domain list starts empty. The docs note that the sandbox covers shell commands only; Claude's file-editing tools run outside it.

Codex CLI has three sandbox levels: `read-only`, `workspace-write` (edit inside the working folder, the default for local work) and `danger-full-access` (no limits, which the docs call not recommended). Network access is off by default.

On Google's side, Gemini CLI enables its sandbox with the `-s` flag or the `GEMINI_SANDBOX` variable (Docker, Podman or an OS mechanism). But Gemini CLI is now mainly for enterprise customers and paid API keys; the newer tool is Antigravity CLI. The Antigravity app has three built-in profiles: Default (sandbox on, commands outside the box need approval), Request Review (always ask) and Turbo (sandbox off, full file-system access). The command-line version has no built-in profiles, so you write your own allow, deny and ask rules in its settings file.

![A glass box where the agent works, with important things kept outside the fence](https://phatdev.net/uploads/blog/ai-agent-safety-on-your-machine/sandbox-1920.webp)

## 3. Ask-first modes, and the mode that skips everything

Every tool has a dial between "ask at each step" and "do it all". Codex splits it in two: the sandbox decides what the agent can touch, and the approval policy (`on-request` or `never`) decides when it asks you. Claude Code has `default`, `acceptEdits`, `plan` (read and plan only), `auto` (a second model reviews actions in your place) and `bypassPermissions`.

The last one, which skips all checks, is documented as meant only for isolated containers and virtual machines. Codex has a flag `--dangerously-bypass-approvals-and-sandbox` described as extremely dangerous and intended solely for environments that are already sandboxed from outside. Put simply: a "never ask" mode belongs inside a box you are willing to throw away entirely. For an unfamiliar project, let the agent plan first and only then let it edit.

## 4. Never hand over passwords

Do not paste passwords, API keys or private keys into the chat, and do not let the agent read them. Forbid reading secret files with a rule (for Claude Code, `Read(./.env)`). If the agent needs an outside service, make it a separate low-permission key and revoke it when the job is done.

On a real server, do not let an agent use the database admin account. Create a read-only account or, better, let it work on a copy (staging). Claude Code also has credential masking in its sandbox: commands see only a placeholder, and the real value is attached only when sending to domains you allow.

## 5. A separate git branch for every job

Before the agent touches code, create a new branch and make sure the working folder is clean. The Codex docs recommend exactly this: use a feature branch, keep git status clean, commit often, so the agent's changes are easy to isolate and discard.

Git also shows exactly what the agent changed. Claude Code's checkpoint feature snapshots files before each edit, but the docs state it only tracks changes made through its file-editing tools, misses changes made through Bash commands, and is not a replacement for git.

![A separate git branch for the agent, and a backup store underneath](https://phatdev.net/uploads/blog/ai-agent-safety-on-your-machine/safetynet-1920.webp)

## 6. Back up before you let an agent delete

Claude Code's accept-edits mode (`acceptEdits`) lets commands like `rm`, `mv` and `cp` inside the working folder run without asking. Convenient, but it also means a wrong delete has nobody to stop it. So before any session that might delete or overwrite, back the folder up, then open the backup to check it reads. A backup you have never opened is not yet a backup. The full method is in [Website Backups Done Right: The 3-2-1 Rule and Testing Your Restores](https://phatdev.net/en/blog/website-backup-3-2-1).

## 7. Read the command before you approve it

The Claude Code docs say plainly that reviewing commands is your responsibility. They also admit the familiar problem: by the tenth approval people click through instead of reading. The cure is to pre-approve harmless commands such as lint and tests, so any prompt that does appear deserves a real read.

When reading, ask what the command touches, whether it deletes or overwrites anything, and whether it sends data out. Be extra careful with commands that download something from the internet and run it at once, or that come out of content you do not control, like a web page or a stranger's file, because an attacker can plant instructions there to trick the AI (called prompt injection). That is why Claude Code does not auto-approve `curl` and `wget` by default.

![A checkpoint gate where the command is inspected before it passes](https://phatdev.net/uploads/blog/ai-agent-safety-on-your-machine/approval-1920.webp)

## For readers who write code

I ran the commands below in a scratch folder. The Codex flags I confirmed with `codex --help` (version 0.144.5); I did not run a real session.

Before you hand over a job: back up, test the backup, then create a branch.

```bash
tar czf ~/backup-before-agent.tgz my-project/   # back up the whole folder
gzip -t ~/backup-before-agent.tgz && echo "backup readable"
cd my-project && git switch -c ai/export-excel   # own branch for the agent
# ... the agent works ...
git diff --stat                                  # see what it changed
git switch main && git branch -D ai/export-excel # discard the branch if unhappy
```

This backup contains your `.env` file, so store it somewhere safe.

Deny rules for Claude Code, in the project's `.claude/settings.json`:

```json
{
  "permissions": {
    "deny": [
      "Read(./.env)",
      "Read(./secrets/**)",
      "Bash(git push *)",
      "Bash(curl *)"
    ]
  }
}
```

Remember the docs say a `deny` rule matches the command as written, so a differently written command can slip past. Rules are a side layer; the sandbox is the real block.

Codex at a moderate setting: edit inside the project, ask when it needs to go beyond:

```bash
codex --sandbox workspace-write --ask-for-approval on-request
```

## What to do next

Next time you hand a job to an agent, try all seven steps: ordinary user, sandbox, ask first, no secret files, own branch, backup, read the command. If you want a safe setup for AI working on your own server, I offer advice through the contact page. If you are just starting, read [Common Problems When Using AI to Write Code, and How to Avoid Them](https://phatdev.net/en/blog/ai-coding-common-problems) first.

## References

- [Claude Code - Security](https://code.claude.com/docs/en/security)
- [Claude Code - Permission modes](https://code.claude.com/docs/en/permission-modes)
- [Claude Code - Permissions](https://code.claude.com/docs/en/permissions)
- [Claude Code - Sandboxing](https://code.claude.com/docs/en/sandboxing)
- [Claude Code - Best practices](https://code.claude.com/docs/en/best-practices)
- [Codex - Agent approvals and security](https://learn.chatgpt.com/docs/agent-approvals-security)
- [Codex - Sandboxing](https://learn.chatgpt.com/docs/sandboxing)
- [Gemini CLI - Sandboxing](https://geminicli.com/docs/cli/sandbox/)
- [Antigravity - Permissions](https://antigravity.google/docs/permissions)

## Related posts

- [Common Problems When Using AI to Write Code, and How to Avoid Them](https://phatdev.net/en/blog/ai-coding-common-problems.md)
- [Website Backups Done Right: The 3-2-1 Rule and Testing Your Restores](https://phatdev.net/en/blog/website-backup-3-2-1.md)
- [Claude, Codex and Gemini: Which AI Coding Assistant for Which Job](https://phatdev.net/en/blog/claude-codex-gemini-for-coding.md)