The same account, the same permissions

One fact explains everything below. An AI coding agent isn't a separate, restricted kind of user. It's an ordinary process started by your account, using the same system calls as any other program, usually subprocess or exec() to run commands. The operating system has no notion of "this process is an AI, treat it differently". It can do anything your account can, because as far as macOS is concerned, your account is what's asking.

Shell: commands run as if you typed them

When an agent runs a command, it uses the same shell a terminal would, with the same working directory, the same PATH and the same ability to chain commands. Nothing sits in between checking intent. The shell doesn't know or care whether a person or a model chose the string.

Files: whatever the process can open

File access follows ordinary permissions. If your account can read or write a path, so can a process it started: your home folder, your dotfiles, any project the agent was opened in. Being an agent doesn't narrow that. For the concrete list on a typical Mac, see what an AI coding agent can access.

Git: the agent's commits are ordinary Git

An agent running git commit or git push, or installing a hook, uses Git exactly as designed. Git has no separate trust level for who's calling it. Anything Git is set up to trust for you (a stored credential helper, an SSH key loaded in your agent, a hook that runs automatically) the agent can use too.

Package managers: installers run code by design

A pip install, npm install or brew install started by an agent isn't sandboxed by the package manager. setup.py scripts, npm install hooks and Homebrew formulae can all run arbitrary code during a normal install, exactly as they would if you'd typed the command. The same risk with no agent at all is just you following an unfamiliar repository's setup steps.

Network: outbound calls are outbound calls

Unless something outside the agent restricts it (a firewall rule, a network namespace, a VM boundary), the agent can make the same outbound requests as any process of yours. At the network layer it looks like traffic from your Mac, because that's what it is.

Environment variables: readable like printenv

A process inherits its parent's environment. Whatever is exported there, API keys, cloud credentials, tokens meant for another tool, is visible to an agent just as to any other process you started.

None of this is a flaw in one agent

Everything above is standard, decades-old operating system behavior, not a bug in any particular agent. Processes inherit the permissions of the account that started them, whether it's a shell script, a build tool or an AI agent. That's why real isolation can't come from the agent being more careful; it has to come from a boundary outside the agent's process, a container's namespace or a VM's separate kernel, covered in VM vs. container vs. sandbox on macOS. For what goes wrong without one, and which isolation level would have stopped each case, see the security deep dive.

Related reading: what an agent can access on your Mac, VM vs. container vs. sandbox on macOS, and running AI agents safely in an isolated VM. Or download Velo Workspaces and try it yourself.