Coding agents are increasingly capable, but most development environments were never designed to run untrusted, autonomous code with access to our tools, files, and networks. In this talk, I describe how I use a development sandbox for coding agents on macOS. By sharply limiting user permissions inside the sandbox, I reduce the agent’s access to private data and significantly constrain its blast radius – addressing the first and most obvious security risk.
Restricting file system access alone is not sufficient, however. Building on Simon Willison’s “lethal trifecta,” this talk explores additional measures for reducing the risks introduced by unrestricted network access and exposure to untrusted content. I discuss approaches for enforcing explicit network policies, removing the need for constant human oversight while still preventing arbitrary communication and data exfiltration. The goal is not perfect isolation, but a development setup that makes agent-assisted workflows safer by default without sacrificing usability.
