If you're running AI agents on your Windows machine, you need to know about this simple sandboxing trick.
AI agents are powerful, but they can also be dangerous. They might delete files you didn't want them to, or modify things they shouldn't. The solution is simple: give the agent its own drive letter.
How It Works
Here's what I do:
- Create a dedicated folder for the AI agent's work
- Map that folder to a drive letter on Windows
- Point the agent only at that drive
The agent sees only that drive. It can't touch anything outside. OS-level isolation, no VM overhead.
Two Tools, Two Scenarios
I use two tools depending on where the files live:
Local Files: ScsSubst
If the agent works with local files, I use ScsSubst to map the local folder to a drive letter.
It's lightweight, portable, and one-time purchase. Way cheaper than dealing with accidentally deleted files.
Cloud / WebDAV Files: ScsDrive
If the data lives in the cloud (WebDAV, NAS, etc.), I use ScsDrive to mount the cloud folder as a drive.
Same isolation, no local safety concerns. The agent works with cloud files but still can't escape the drive.
Why This Is Simple
I've tried other approaches:
- VMs — slow, heavy, annoying to share files
- Containers — requires Docker setup, still complex
- Restricted user accounts — clunky, doesn't fully isolate
Drive letter isolation is:
- Instant — map a folder and you're done
- Lightweight — no VM overhead
- Simple — the agent sees a regular drive, no special config
- Cheap — way cheaper than backup software
Give It a Try
Next time you run an AI agent, don't give it your whole filesystem. Create a dedicated folder, map it to a drive, and let the agent work inside that drive only.
Both are one-time purchases, way cheaper than dealing with accidentally deleted files.
Top comments (0)