Setting up a virtual machine to run AI agents safely is overkill. There's a much simpler solution.
After losing a whole project folder to an overzealous AI agent, I tried VMs, containers, restricted user accounts — nothing was as simple as giving the agent its own drive letter.
The Simple Solution
Here's what I do:
- Create a dedicated folder for the AI agent's work
- Map that folder to a drive letter on Windows
- Point the agent only at that drive
The agent sees only that drive. It can't touch anything outside. OS-level isolation, no VM overhead.
Two Tools, Two Scenarios
I use two tools depending on where the files live:
Local Files: ScsSubst
If the agent works with local files, I use ScsSubst to map the local folder to a drive letter.
It's lightweight, portable, and one-time purchase. Way cheaper than dealing with accidentally deleted files.
Cloud / WebDAV Files: ScsDrive
If the data lives in the cloud (WebDAV, NAS, etc.), I use ScsDrive to mount the cloud folder as a drive.
Same isolation, no local safety concerns. The agent works with cloud files but still can't escape the drive.
Why This Beats VMs
VMs work, but they're:
- Slow to start
- Resource-heavy
- Annoying to share files between host and guest
Drive letter isolation is instant and lightweight. The agent works with regular files on a regular drive, no special configuration needed.
Give It a Try
Next time you run an AI agent, don't give it your whole filesystem. Create a dedicated folder, map it to a drive, and let the agent work inside that drive only.
Both are one-time purchases, way cheaper than dealing with accidentally deleted files.
Top comments (0)