Let me tell you about the time an AI agent deleted my entire project folder.
I was using an AI coding assistant to help refactor a codebase. I gave it access to my working directory and walked away. When I came back, half the files were gone. The agent thought it was "cleaning up" unused files.
I lost hours of work. That's when I started thinking about proper sandboxing for AI agents.
The Real Problem with AI Agents
AI agents are powerful, but they're also unpredictable. They:
- Interpret instructions literally
- Don't understand context you didn't explicitly state
- Make assumptions about what's "safe" to delete
Giving an AI agent full filesystem access is like giving a toddler a box of matches. You might trust them, but accidents happen.
My Solution: Drive Letter Isolation
After trying various approaches (containers, VMs, restricted user accounts), I settled on something much simpler: map a dedicated folder to a drive letter.
Here's how it works:
- Create a dedicated working folder for the AI agent
- Map that folder to a drive letter on Windows
- Point the AI agent only at that drive
The agent sees only that drive. It can't touch anything outside. OS-level isolation, no VM overhead.
Two Tools for Two Scenarios
I use two tools depending on where the files are:
Local Files: ScsSubst
If the agent works with local files, I use ScsSubst to map the folder to a drive letter.
It's lightweight, portable, and doesn't require installation. One-time purchase, no subscription. Way cheaper than setting up a VM for every project.
Cloud / WebDAV Files: ScsDrive
If the data is in the cloud (WebDAV, NAS, etc.), I use ScsDrive to mount the cloud folder as a drive.
Same isolation, no local safety concerns. The agent works with cloud files but still can't escape the drive.
Why This Beats VMs and Containers
I tried VMs first. They work, but:
- They're slow to start
- They use a lot of resources
- Sharing files between host and VM is annoying
Containers are better, but they still require Docker/container runtime setup.
Drive letter isolation is:
- Instant — map a folder and you're done
- Lightweight — no VM overhead
- Simple — the agent sees a regular drive, no special configuration needed
- Cheap — way cheaper than backup software or VM licenses
Give It a Try
Next time you run an AI agent on your machine, don't give it your whole filesystem. Create a dedicated folder, map it to a drive, and let the agent work inside that drive only.
Both are one-time purchases. After losing a whole project folder, I'd say that's a bargain.
Top comments (0)