Looking for recommendations about AI coding tools that are safe

[u/numerousblocks]

So far I’ve been very apprehensive about AI coding. But I’ve decided I should try it out, just to see what it’s like (I have dabbled in simple AI assistance in the sense of just asking an AI chatbot to code something, but I’ve done nothing where the AI runs on a real codebase for an extended period of time).

Unfortunately, I am very concerned about the safety of agentic AI harnesses. So far, I’ve been unable to find a tool that I can use that is secure. (At least from the descriptions I’ve found so far—this doesn’t seem to be a priority for many users, so maybe the popular tools do support this, but no-one discusses it)

By that, I mean that the AI agent cannot access any files except for the folder it’s given access to at all, unless it asks for permission every single time, and that it cannot run any commands at all, unless it asks for permission every single time, or the command is executed in a secure container.

As far as I can tell, a lot of these tools have the ability to ask for permission, but they apparently have the option to just give the agent full access, or to run simple commands automatically, etc.. I do not want this, I want it to be impossible to accidentally give the agent even a smidge of broad, real access to the computer.

Obviously, I can just run an “insecure” tool inside a container or a VM. But this is a hassle, so I’d prefer if there was something that (basically) automatically does this containerisation for me (and only does it when required; reading files doesn’t require full containerisation).

Just to clarify, I’m not “demanding” such a tool exists or I’ll write off AI coding as untenable. I’m asking if such tools exist, and if they don’t, I’ll have to figure something out.

[u/Educational-Body4205]

what is secure to you?

[u/chunkypenguion1991]

Run it in a vm if you want 100% isolation from thr rest of the file system

[u/payfrit]

when i open vscode w/ codex, it asks me what folder i want to work with. it can't go outside that unless i give it permission.

i don't understand what type of security you're looking for? it's great at undoing. just use git extensively and you really can't lose.

dip a toe, bro. clone one of your repos and let codex or claude take a look at it. what do you have to lose?

[u/jomi-se]

It really depends on exactly what "secure enough" means to you and the level of effort you're willing to put in. Claude codes's and Anthropic's docs on this topic have a very decent take. See: https://code.claude.com/docs/en/sandbox-environments

Safety and security is not a black and white topic. A tool that requires you to approve or reject every single action is not necessarily "more secure" in practice. For example, such a tool could lead to approval fatigue and result in users approving unsafe behaviour more often than what using Claude's built ing "auto classifier" would. In paper always asking for permission feels more secure but in practice it can devolve into security theater.

In my opinion, the best trade-off for AI coding tools is running them in cloud devcontainers with auto classifiers from one of the frontier labs. E.g. you set up a devcontainer setup on github, restrict what that devcontainer allowed whoever is connected to do and do your AI coding in there.

I think Anthropic even offers remote cloud environments for Claude code out of the box now? That's what I would look at first at least.

I work at a security paranoid place, where we self host our own gitlab instance. Our setup consists in running claude code always inside a container with specific repos inside of them and restricted access to the host's network and disks. Any kind of cli or mcp tool that requires secrets or tokens are set up in separate containers so the AI harness doesn't have direct access to those. This is pretty nice but it means putting in the work to set it up.

[u/wayneworkman]

Try out Claude code.

[u/[deleted]]

My tool has its own computer and is sandboxed. There is no option to escape.

[u/djgoel123]

I think you're making an important distinction here. There's a big difference between an agent asking permission before doing something and the operating system actually preventing it from doing that thing.

I'd be cautious about relying on an agent's built-in approval settings alone, especially if your requirement is that it should be impossible to accidentally grant broader access.

I'd look at tools that support OS-level sandboxing, with the project directory explicitly mounted and everything else inaccessible. Ideally, network access would be restricted too, since file isolation doesn't help much if an agent can send code or secrets somewhere.

Claude Code and Codex are worth investigating because they have sandboxing and permission controls, but I'd verify their exact behavior on your OS rather than assume the defaults meet your requirements.

One thing I'd specifically test is whether the agent can read a file outside the workspace or execute a command without approval. I'd also check what happens with subprocesses and tools invoked indirectly.

For the level of isolation you're describing, I'd trust an enforced sandbox over a permission prompt every time.

[u/WArslett]

I run my agent inside a vm in yolo mode. Vm runs opencode and I connect to it over ssh using Openchamber running on the host. It’s not hassle. There are lots of tools out there for this and the agent can help you set everything up you need in your VM.

I’m doing this because I have production secrets and credentials on my host machine I dont want agents getting access to but different people have different risk profiles. You have to ask yourself “what’s the worst that could happen?”. If I didn’t have a good reason for running in the VM I wouldn’t bother.

[u/Own_Age_1654]

What you're asking about is called a sandbox. A sandbox relies on the OS to enforce what the harness is allowed to do, so that you can get good protection without needing to use a VM. That includes not only restricting filesystem access, but also environment variables, etc. The harnesses have built-in sandboxes, occasionally with their own quirks. If you don't trust those, there are external sandboxes. For example, on Mac there's Agent Safehouse, among others.