Let me start with a story: I gave an AI agent access to my whole filesystem to help me organize my files. I walked away for 10 minutes. When I came back, my entire Documents folder was gone.
The agent thought it was "cleaning up" unused files. It didn't know those files were important to me.
That's when I learned: never give an AI agent full filesystem access. Instead, give it its own drive letter.
The Solution
Here's what I do now:
- Create a dedicated folder for the AI agent's work
- Map that folder to a drive letter on Windows
- Point the agent only at that drive
The agent sees only that drive. It can't touch anything outside. OS-level isolation, no VM overhead.
Two Tools, Two Scenarios
I use two tools depending on where the files live:
Local Files: ScsSubst
If the agent works with local files, I use ScsSubst to map the local folder to a drive letter.
It's lightweight, portable, and one-time purchase. Way cheaper than dealing with accidentally deleted files.
Cloud / WebDAV Files: ScsDrive
If the data lives in the cloud (WebDAV, NAS, etc.), I use ScsDrive to mount the cloud folder as a drive.
Same isolation, no local safety concerns. The agent works with cloud files but still can't escape the drive.
Why This Works
This approach gives you:
- OS-level isolation — the agent can't escape the drive
- No VM overhead — no virtual machine to set up and manage
- Simple workflow — just map a folder and point the agent at it
- Cheap — way cheaper than backup software or VM licenses
Give It a Try
Next time you run an AI agent, don't give it your whole filesystem. Create a dedicated folder, map it to a drive, and let the agent work inside that drive only.
Both are one-time purchases. After losing my entire Documents folder, I'd say that's a bargain.
Top comments (0)