Checklist

How to Build a Safe Local AI Agent Environment

Everything else on this blog about AI agent security explains why. This is deliberately the other format: a checklist, in the order to actually think about it, each item linking to the reasoning instead of repeating it.

Before you run anything

Know the mechanism isn't special. An agent's process gets the same OS-level permissions as the account that launched it — no separate, more restricted tier exists. See how AI coding agents use your computer.
Know what's actually reachable. SSH keys, cloud credentials, GitHub CLI tokens, shell history, project .env files — a concrete inventory, not a guess. See what can an AI coding agent actually access.

Choosing the environment

Run it in a VM, not a container alone. A container shares the host kernel; a VM's boundary holds even against a kernel-level compromise inside the guest. See VM vs. container vs. sandbox on macOS and the isolation-level evidence.
Make it disposable, not persistent. A successful compromise, an accidentally installed Git hook, a leftover credential in shell history — none of it should outlive the session that caused it. See what is a disposable development environment.
Start every session from a known-good base image, not a hand-configured one. A disposable environment only stays fast and consistent if recreating it is cheap. See base images as versioned infrastructure.

If the agent touches a real Git repository

Don't assume a fresh clone's hooks are inert. A repository using Husky, pre-commit, or Lefthook can install hooks as a normal part of its own setup instructions. See can you trust an AI coding agent with your Git repository.

Running a model alongside the agent

Keep the model on the host, the agent in the guest. Splitting them is what gets you real isolation without giving up GPU speed. See the complete AI agent guide and the architecture behind it.

The two that aren't about the environment at all

Scope what data and long-lived credentials the session can reach, separately from execution isolation. A perfectly isolated VM doesn't help if the model itself can be talked into handing over something it was already allowed to see.
Don't rely on prompt-injection defenses holding. Treat isolation as the thing that has to work even when a defense doesn't, not the second line behind it.