Frequently Asked Question

Is it safe to let an AI agent run shell commands?

It carries real risk, and the risk is manageable in layers.

The strongest and simplest mitigation is isolation: run the agent inside a virtual machine or container you are prepared to destroy. If a session goes wrong you discard the machine. This is why the video accompanying Chapter 22 sets up a Linux VM before installing anything.

Below that sit permission rules, which decide whether a command runs at all, and the sandbox, which restricts what a command can reach once it does. Deny rules are worth configuring even on a throwaway machine: blocking reads of .env files and ~/.ssh/** costs nothing and closes the most damaging category of accident.

Be clear about what each layer gives you. Permission rules are checked by the client against the command string. The sandbox is enforced by the kernel, so it holds even when a command does more than its name suggests. Neither is a substitute for a virtual machine when you need a hard boundary.