curl | bash: convenient, and exactly as trusting as it looks

Piping a remote script into a shell is a common install pattern, and it means trusting three things at once: the script's contents (which you rarely read first), the domain serving it (not compromised, not a lookalike), and everything in between at that moment. The same URL can even serve different content to a browser than to a piped curl. None of that is unique to this pattern, but "just run this one command" makes it easy to skip the pause a downloaded, inspected file would give you.

A repository's own setup steps run the same way

npm install, pip install -e . and make aren't sandboxed by the tools running them. They execute whatever the project's install hooks, setup.py or Makefile say, the same mechanism described in how AI coding agents use your computer, minus the agent. Cloning an unfamiliar repository and following its README is running code you haven't reviewed, AI or not.

Building from source isn't automatically safer

There's an instinct that compiling something yourself is more trustworthy than a prebuilt binary. Sometimes that's true for supply-chain reasons, but it does nothing for this risk. A build script can do anything a shell script can, because it usually is one or calls one. "I built it myself" tells you where the binary came from, not whether the build did something you wouldn't want.

Dependencies you never chose to audit

Even a project whose own code you trust pulls in a dependency tree you almost certainly haven't reviewed, and any package in it running install hooks is the same risk one step removed. That's the general shape of supply-chain risk, whether you install the tool yourself or an agent does.

The boundary that helps either way

Being more careful about which untrusted software you run only goes so far. The fix is the one this blog keeps arriving at for AI agents: run it where a bad outcome can't reach your account (see VM vs. container vs. sandbox on macOS). Try the install, the build or the new tool in a disposable workspace, or in a fresh cloud image of Ubuntu or Debian that's ready in a minute. If it's fine, install it properly wherever you normally would. If it isn't, close the workspace, and your Mac was never involved.

Related reading: how AI coding agents use your computer for the same mechanism with an agent, VM vs. container vs. sandbox on macOS, and what a disposable development environment is. Or download Velo Workspaces and try it yourself.