AI Agent Sandboxing: A Practical Safety Checklist for Developer Laptops

Start with the threat model

The practical question is not whether AI agents are good or bad. The question is what the agent can read, write, execute, and send over the network during a session.

A safe setup begins by limiting the blast radius. Give the agent access to the project it needs, not your entire home directory, SSH keys, browser profiles, production credentials, and private documents.

Limit filesystem access

Use project-specific workspaces whenever possible. Avoid running agents from a directory that contains unrelated projects or sensitive files.

Before granting broad access, check whether the task really needs it. Most coding tasks only require the repository, package manager cache, and temporary files.

• Keep secrets out of the repository.
• Avoid exposing your full home directory.
• Use temporary folders for experiments.
• Review generated files before committing.
• Keep backups before large automated edits.

Control credentials and tokens

Credentials are the highest-risk part of AI-assisted development. An agent that can read environment files, shell history, cloud credentials, or deployment tokens can accidentally expose them through logs, commands, or external tool calls.

Use short-lived tokens where possible, separate development credentials from production credentials, and avoid pasting secrets into prompts.

Restrict network access

Network access is useful for package installation, documentation lookup, API calls, and deployment. It is also a path for accidental data exposure.

For sensitive projects, prefer explicit allowlists: package registries, official documentation, your staging environment, and approved internal services. Block or review unexpected destinations.

Review MCP tools before enabling them

MCP tools can connect an agent to databases, cloud platforms, browsers, ticketing systems, file stores, and deployment systems. That makes tool review as important as dependency review.

Before installing a new MCP server or skill, inspect its source, permissions, commands, network behavior, and whether it asks for long-lived credentials.

• Prefer official or well-maintained tools.
• Check what files and services the tool can access.
• Avoid tools that require broad production credentials by default.
• Run unfamiliar tools in a disposable environment first.
• Remove tools you no longer use.

Use a staging-first workflow

AI agents should not be allowed to make production changes casually. For hosting operations, use staging environments, preview deployments, dry-run commands, and human review before touching production.

This is especially important for DNS changes, firewall rules, database migrations, server cleanup, and deployment scripts.

Conclusion

AI agent sandboxing is not only an enterprise problem. Individual developers and small hosting teams also need simple boundaries around files, credentials, network access, MCP tools, and production systems.

A good rule is simple: make the agent powerful enough to help, but not powerful enough to damage everything in one mistake.