DEV Community

疏影
疏影

Posted on

AI Agent Sandboxing: The Drive Letter Approach

Running AI agents on your local machine is great for productivity, but it comes with a real risk: what if the agent deletes the wrong files?

After losing a whole project folder to an overzealous AI agent, I found a simple solution: give the agent its own drive letter.

The Approach

Here's what I do:

  1. Create a dedicated folder for the AI agent's work
  2. Map that folder to a drive letter on Windows
  3. Point the agent only at that drive

The agent sees only that drive. It can't touch anything outside. OS-level isolation, no VM overhead.

Two Tools, Two Scenarios

I use two tools depending on where the files live:

Local Files: ScsSubst

If the agent works with local files, I use ScsSubst to map the local folder to a drive letter.

It's lightweight, portable, and one-time purchase. Way cheaper than dealing with accidentally deleted files.

Cloud / WebDAV Files: ScsDrive

If the data lives in the cloud (WebDAV, NAS, etc.), I use ScsDrive to mount the cloud folder as a drive.

Same isolation, no local safety concerns. The agent works with cloud files but still can't escape the drive.

Why This Approach Works

This approach gives you:

  • OS-level isolation — the agent can't escape the drive
  • No VM overhead — no virtual machine to set up and manage
  • Simple workflow — just map a folder and point the agent at it
  • Cheap — way cheaper than backup software or VM licenses

Give It a Try

Next time you run an AI agent, don't give it your whole filesystem. Create a dedicated folder, map it to a drive, and let the agent work inside that drive only.

Both are one-time purchases, way cheaper than dealing with accidentally deleted files.

Top comments (0)