How to Run AI Coding Agents More Safely in YOLO Mode
Summary
The article explains the risks of letting AI coding agents run commands without approval and recommends using disposable containers or VMs, scoped credentials, restricted networking, non-root access, and limited project files.
Key points
- YOLO mode lets an agent execute commands without pausing for approval, potentially allowing unsafe downloads, destructive actions, or data exposure.
- The article describes Claude Code modes ranging from manual approval and planning to automatic operation and bypassing permissions.
- Run fully autonomous agents in an isolated, disposable container or virtual machine rather than on a primary system.
- Keep SSH keys, cloud logins, and password-manager credentials out of the environment; use scoped, short-lived tokens when needed.
- Restrict network access to what the task requires, and run the agent as a non-root user.
- Mount only the necessary project files and take a snapshot before major runs so the environment can be restored.
Article Details
- Defense Focus
- Safely run autonomous AI coding agents by isolating them from the host system and limiting their access, credentials, privileges, and network.
- Platforms
- Containers
- Virtual machines
- Defensive Actions
- Run agents in an isolated, disposable container or virtual machine rather than directly on the main system.
- Keep SSH keys, cloud logins, and password-manager credentials away from the agent; provide only a scoped, short-lived token when needed.
- Restrict network access to connections required for the task.
- Run the agent as a non-root user.
- Mount only the project folder the agent needs, and take a snapshot before significant runs.
- Use a permission mode that asks for approval for routine work; reserve YOLO mode for disposable environments.
People
Products
Claude CodeTL;DR: Most people run AI coding agents like Claude Code in YOLO mode: full access to their machine, no questions asked.CodexRunning a different agent, like Codex or Cursor? Let me know in the comments and let’s discuss it how the permissions are handled there!CursorRunning a different agent, like Codex or Cursor? Let me know in the comments and let’s discuss it how the permissions are handled there!