AI Agent Sandboxing: The Simple Solution You've Been Missing

If you're running AI agents on your machine and not sandboxing them properly, you're one accident away from losing important files.

After losing a whole project folder to an overzealous AI agent, I found a simple solution that most people don't know about: give the agent its own drive letter.

The Solution

Here's what I do:

1. Create a dedicated folder for the AI agent's work
2. Map that folder to a drive letter on Windows
3. Point the agent only at that drive

The agent sees only that drive. It can't touch anything outside. OS-level isolation, no VM overhead.

Two Tools, Two Scenarios

I use two tools depending on where the files live:

Local Files: ScsSubst

If the agent works with local files, I use ScsSubst to map the local folder to a drive letter.

It's lightweight, portable, and one-time purchase. Way cheaper than dealing with accidentally deleted files.

Cloud / WebDAV Files: ScsDrive

If the data lives in the cloud (WebDAV, NAS, etc.), I use ScsDrive to mount the cloud folder as a drive.

Same isolation, no local safety concerns. The agent works with cloud files but still can't escape the drive.

Why This Is The Solution You've Been Missing

I've tried other approaches:

• VMs — slow, heavy, annoying to share files
• Containers — requires Docker setup, still complex
• Restricted user accounts — clunky, doesn't fully isolate

Drive letter isolation is:

• Instant — map a folder and you're done
• Lightweight — no VM overhead
• Simple — the agent sees a regular drive, no special config
• Cheap — way cheaper than backup software

Give It a Try

Next time you run an AI agent, don't give it your whole filesystem. Create a dedicated folder, map it to a drive, and let the agent work inside that drive only.

• Local files: try ScsSubst
• Cloud / WebDAV files: try ScsDrive

Both are one-time purchases, way cheaper than dealing with accidentally deleted files.