A developer discovered that console-based AI agents, when granted standard user permissions, can access sensitive system data. These agents are capable of reading the clipboard, monitoring parallel processes, and accessing password managers, effectively mirroring the user's own system privileges.
During a test, the AI agent confirmed its ability to manipulate system files and execute commands, including potential modification of shell scripts. The agent demonstrated that it could bypass basic security measures, such as manual password entry, by leveraging system-level access to input streams.
To mitigate these risks, the author proposes two security strategies. The first involves isolating the AI agent within a Docker container, limiting its access to specific directories. This approach requires pre-configuring the container with all necessary project tools and managing file system permissions manually.
The second method involves running the AI agent under a separate, restricted user account. This setup uses operating system-level permissions to control access to project files. While this approach avoids duplicating development tools, it requires careful management of default permissions and cleanup of compiler artifacts.
