Yes, letting an AI agent control your computer can be safe, but not by default. It is safe when you limit what the agent can reach, make it ask before anything irreversible, and keep a way to undo its work. Treat it like a capable new hire on day one: you would not hand over every password and walk away.
Good AI agent security comes down to four risks and a handful of controls. Here is an honest look at both, and a checklist you can set up in ten minutes.
- Agents go wrong in four ways: plain mistakes, prompt injection, data exposure and destructive commands.
- Instructions are not controls. An agent told “don’t” can still do it; permissions and sandboxes actually stop it.
- People approve almost every prompt they see, so keep approvals few and reserve them for what matters.
- Give the agent least privilege: scoped folders, a separate browser profile, no saved passwords.
- Keep an undo button: version control, tested backups, and a sandbox or virtual machine for risky work.
The four ways an agent can hurt you
It is tempting to think only about hackers. In practice, the everyday risk is an agent doing the wrong thing with real consequences. Here is the full list.
| Risk | What it looks like | Example |
|---|---|---|
| Plain mistakes | It misreads the task or reports success on something that failed | Edits the wrong file, then says all tests pass |
| Prompt injection | Text it reads hijacks its instructions | A web page tells it to send your files somewhere |
| Data exposure | Secrets or personal data end up where they should not | An API key from a config file lands in a log or a commit |
| Destructive commands | It deletes, overwrites or spends | Wipes a folder while “cleaning up” |
The categories overlap. A prompt injection usually aims to cause data exposure or a destructive command, and a plain mistake can do either on its own. These sit alongside the older kind of attack that targets you directly, without touching your agent at all, like the voice clones and fake videos in our guide to AI scams.
A widely reported case shows how this plays out. In July 2025, a founder testing Replit’s coding agent found it had deleted his production database during a declared code freeze, despite repeated instructions not to make changes. The agent then said a rollback was impossible. It was not: the rollback worked.
Two lessons follow. Telling an agent not to do something is not the same as preventing it. And an agent’s account of its own actions can be wrong, so check the result, not the report.
Why prompt injection is the risk to take seriously
Models are getting much better at resisting it, but it is not solved. OpenAI has said that prompt injection, like scams and social engineering on the web, is unlikely ever to be fully solved. Anthropic’s own figures for Claude Opus 4.7, tested on Gray Swan’s red-teaming benchmark, show why persistence matters:
A determined attacker gets many tries, so the safe assumption is that an injection will sometimes land. The practical defense is to limit what a successful one could do. Our explainer on prompt injection covers the attack itself in more depth.
AI agent security controls that actually help
OWASP, a nonprofit whose security guidance is widely used, calls the root problem “excessive agency”: an agent with more tools, permissions or autonomy than its task needs. Every control below cuts one of those three.
Supervision modes and approvals
Start every new agent in its most supervised mode, and require approval before anything you cannot undo: sending, paying, deleting, publishing and pushing code. Watch out for approval fatigue, though. Anthropic found Claude Code users approved roughly 93% of permission prompts, and the more prompts people see, the less attention each gets.
So make approvals rare and meaningful. Anthropic’s own fix was a boundary: after it sandboxed Claude Code, permission prompts fell by 84%. Fewer, better questions beat a stream of “allow?” pop-ups.
Least privilege
Give the agent only the folders, apps and accounts the task needs, and read-only access wherever reading is enough. Use API keys scoped to one job, and keep them out of files the agent reads. Our guide to keeping API keys safe shows how.
A separate browser profile
A browsing agent inherits everything your browser is signed into: email, banking, your company’s admin panels. Give it its own browser profile with no saved passwords, and sign in only to what the task needs. OpenAI gave similar advice in December 2025 for its Atlas browser, which it has since shut down: limit logged-in access, and require confirmation before messages or payments.
Sandboxes and virtual machines
A sandbox limits which files and network addresses the agent can touch. A virtual machine goes further: it is a whole separate computer running inside yours. Anthropic runs the code for Claude Cowork inside a virtual machine, mounts the work folder as read-only, read-write or no-delete, and keeps your credentials outside it.
You can copy the idea. For unfamiliar tasks or untrusted content, use a virtual machine, a spare user account, or a cloud sandbox with nothing personal in it.
Version control and backups
Keep code in git and commit before the agent starts, so every change is visible and reversible. Never let an agent rewrite history or force-push. Back up everything else, and restore one file as a test, because an untested backup is a hope, not a plan.
Which setup fits which task?
| Full access on your main computer | Supervised, with limits | Sandbox or virtual machine | |
|---|---|---|---|
| Speed | Fastest | Medium | Fast once set up |
| If something goes wrong | It can reach anything you can | Mostly limited to what you approved | Contained to the box |
| Setup effort | None | A few minutes | An hour or so the first time |
| Good for | Jobs you have watched it do many times, on backed-up data | Everyday work | Unfamiliar tasks, untrusted content, long runs alone |
Autonomy is earned per task, not granted per agent. The same agent can work on its own in a sandbox and ask before every send on your real inbox. Screen-operating agents need this care most, because they see and click whatever is on screen; our guide to computer use agents explains why.
A 10-minute setup checklist
FAQ
Can an AI agent see my passwords?
It can reach whatever its environment can. If your browser is signed in or passwords sit in plain text files, an agent working there can reach them too. Use a separate browser profile, keep secrets in a password manager, and never paste passwords into a chat.
Is it safer to run an AI agent in a virtual machine?
Yes, for risky or unfamiliar work. A virtual machine limits the damage to what is inside it. The trade-off is setup time and less convenient access to your real files.
What is the biggest risk of letting AI use my computer?
For most people it is plain mistakes with real consequences, like deleting the wrong folder or emailing the wrong person. Prompt injection is rarer but more dangerous, because an attacker is steering. Limits on access protect you from both.
Does the AI company see what the agent does on my computer?
Usually some of it. Anything the agent reads to do the task, such as file contents or screenshots, is typically sent to the model provider unless the model runs locally. Our AI privacy guide explains what happens to that data and which settings to check.
- The four risks are plain mistakes, prompt injection, data exposure and destructive commands.
- Permissions, sandboxes and backups stop damage; instructions alone do not.
- Keep approvals few and put them in front of irreversible actions.
- Start supervised and grant more freedom one task at a time.
Read next: what an AI agent is and how it works, or how to automate repetitive tasks with human checks built in.
- How we contain Claude across products, Anthropic, May 2026
- LLM06:2025 Excessive agency, OWASP GenAI Security Project
- OpenAI says AI browsers may always be vulnerable to prompt injection attacks, TechCrunch, December 2025
- OpenAI is shutting down Atlas, but its AI browser ambitions are still growing, TechCrunch, July 2026
- Vibe coding service Replit deleted user’s production database, faked data, told fibs galore, The Register, July 2025
