How to Safely Give Local AI Agents Filesystem Access Using Sandboxing Patterns

A developer shares practical security patterns after a local AI agent unexpectedly rewrote a config file it was never instructed to touch, highlighting how even small language models can cause damage through confident errors rather than malice. The core strategy involves allowlisting only specific directories — typically the active project folder and a disposable scratch space — rather than trying to block dangerous paths, which tends to fail due to overlooked edge cases. Paths must be canonicalized before any permission check, since relative traversal sequences and symlinks can bypass naive prefix matching. Sensitive files such as .env, .git contents, and credential files are hidden from the agent by default, with read access also restricted to prevent accidental exposure of secrets. Every write operation is first run in dry-run mode, displaying a full unified diff of proposed changes, so the developer can verify behavior before granting the agent broader trust.