AI agent security risks in plain words: the 3 things never to give it

Do not give a first agent your whole computer, a key to another service, or permission to act in your name. Start with a small folder and a draft you can read. The useful question is what the configured agent can read, change, and send.

Those three items give a wrong answer more places to travel. An agent can still help inside a smaller boundary. Give it two scrubbed notes, ask for one internal draft, and inspect the draft before anything leaves the folder.

Can AI agents be trusted? Give trust a small job first. You can inspect a copied folder and a draft. You cannot inspect a vague promise that an agent will behave well everywhere.

I write down the boundary before I run anything. A CLAUDE.md file can say, "read these notes and write only here." That sentence describes the job. It does not itself stop a configured session from reaching elsewhere.

Claude Code’s Permissions documentation says Claude Code enforces product permissions, while a prompt or CLAUDE.md changes what the model tries to do. The same documentation says a deny rule wins over an ask or allow rule.

Use a deny rule to block the Claude Code tool pattern it matches. Bash patterns match command text, so another way of starting the same program can evade the pattern. When the filesystem boundary itself must hold, use sandboxing or an operating-system control.

Claude Code’s Security documentation says Manual mode begins with read-only permissions and asks before changes. It describes a working-directory boundary that limits writes to the starting folder and its subfolders unless someone grants more access.

The Security documentation also describes sandboxed Bash as a way to isolate filesystem and network access. It says no system is immune to every attack. Keep the first boundary small, then read every suggested command before you approve it.

My first run would use a copied practice folder. It would contain scrubbed source files, an empty work/ folder, and a job small enough to check by eye.

The fictional local run below directly read two named invented notes. Its write helper made one named internal draft under work/. The helper then received an outside target and returned HELPER_DENIED_OUT_OF_SCOPE before that helper wrote it.

That receipt describes one invented local shell helper. It documents one named write and one named denial for one run. It cannot describe a complete filesystem boundary, an Anthropic sandbox, credentials, accounts, real data, external services, or prompt-injection resistance.

The smaller boundary gives you a question you can answer. You can point to the input files, the output folder, and the action that stopped.

Create a new practice folder and copy in scrubbed files. Do not start from your main work folder.

Write down the job in plain words. For example, read two status notes and write one internal summary under work/.

Open Claude Code from the copied practice folder in Manual mode. Manual mode starts read-only and asks before changes. For this first run, leave the Permissions dialog unchanged, do not add another folder, and do not connect a service.

Ask only for the draft in work/. When Claude Code asks to edit a file or run a command, read the exact path or command. Approve the request for the named draft. Choose No for a request that reaches outside the practice folder.

Keep every external action with a person. The agent can prepare an email, payment note, or record change. A person decides whether to send the email, approve the payment, or save the record change.