The Simple Sandboxing Trick Every AI Agent User Should Know

If you're running AI agents on your local machine, you need to know this simple sandboxing trick.

AI agents are powerful, but they can also be dangerous. They might delete files you didn't want them to, or modify things they shouldn't. The solution is simple: give the agent its own drive letter.

The Trick

Here's what I do:

1. Create a dedicated folder for the AI agent's work
2. Map that folder to a drive letter on Windows
3. Point the agent only at that drive

The agent sees only that drive. It can't touch anything outside. OS-level isolation, no VM overhead.

Two Tools, Two Scenarios

I use two tools depending on where the files live:

Local Files: ScsSubst

If the agent works with local files, I use ScsSubst to map the local folder to a drive letter.

It's lightweight, portable, and one-time purchase. Way cheaper than dealing with accidentally deleted files.

Cloud / WebDAV Files: ScsDrive

If the data lives in the cloud (WebDAV, NAS, etc.), I use ScsDrive to mount the cloud folder as a drive.

Same isolation, no local safety concerns. The agent works with cloud files but still can't escape the drive.

Why This Trick Works

This approach gives you:

• OS-level isolation — the agent can't escape the drive
• No VM overhead — no virtual machine to set up and manage
• Simple workflow — just map a folder and point the agent at it
• Cheap — way cheaper than backup software or VM licenses

Give It a Try

Next time you run an AI agent, don't give it your whole filesystem. Create a dedicated folder, map it to a drive, and let the agent work inside that drive only.

• Local files: try ScsSubst
• Cloud / WebDAV files: try ScsDrive

Both are one-time purchases, way cheaper than dealing with accidentally deleted files.