Stop Letting AI Agents Touch Your C: Drive

Description and use

By mapping a dedicated drive letter in Windows, an AI agent’s workspace is isolated, preventing accidental system file modifications.

Problem

AI coding agents can access and modify sensitive system files such as .ssh and hosts, potentially deleting the entire C: drive.

Outcome

By mapping the agent’s workspace to a dedicated drive letter, the agent’s access is limited to that drive, eliminating the risk of accidental system modifications.

Workflow

• Map a dedicated drive letter for the agent’s workspace using Windows drive mapping (e.g., subst.scsoi.com for local folders or drive.scsoi.com for WebDAV/cloud).
• Configure the AI agent to use the mapped drive as its workspace.
• Run the agent; it can read/write only within the mapped drive.
• The agent cannot see or modify files outside the mapped drive.
• No additional containers or VMs are required.
• The setup is a one-time purchase and configuration.
• Agents can run indefinitely without risking system integrity.

Evidence

Your AI coding agent can read your .ssh folder. It can edit your hosts file. It can delete your whole C: drive if it goes wrong.

Source

Map the agents workspace to its own drive letter. Done.

Source

You dont need Docker Desktop. You dont need a VM. You just need Windows drive mapping, which has existed for 30 years.

Source