If an AI coding agent can browse the internet and execute code, the non-negotiables are the controls that prevent it from becoming a path to data loss, account takeover, malware execution, or runaway spend.

Here’s the short list of must-have safeguards:

1) Strong sandboxing for code execution

• Run in a container or VM, not on the host.
• Use a non-root user.
• Make the filesystem ephemeral or tightly scoped.
• Mount only the minimum necessary directories.
• Block access to sensitive host paths, SSH keys, cloud creds, browser profiles, etc.

2) Strict network controls

• Default-deny network egress.
• Allowlist only the domains or endpoints the agent truly needs.
• Block access to internal networks, metadata services, and private IP ranges unless explicitly required.
• Prefer a proxy that logs and filters all requests.

3) Secrets isolation

• Do not expose production credentials to the agent.
• Use short-lived, least-privilege tokens if any credentials are needed.
• Keep secrets out of environment variables if possible; inject only at the last possible moment.
• Prevent the agent from reading password managers, dotfiles, cloud CLI configs, or browser cookies.

4) Human approval for high-risk actions

Require explicit approval before the agent can:

• send emails or messages,
• make purchases,
• deploy code,
• modify infrastructure,
• access production data,
• change IAM permissions,
• run shell commands that touch sensitive paths,
• upload files or share data externally.

5) Granular tool permissions

• Separate tools for browsing, file edits, shell execution, API calls, and deployment.
• Give the agent only the subset it needs for the task.
• Make destructive tools unavailable by default.
• Time-limit or single-use sensitive permissions.

6) Comprehensive logging and replay

• Log every tool call, command, network request, file write, and external action.
• Record prompts, outputs, and code executed.
• Make logs tamper-resistant.
• Keep enough detail to reconstruct what happened after an incident.

7) Output and action filtering

• Inspect code before execution when possible.
• Block commands that try to:
  • exfiltrate data,
  • disable logging,
  • download and execute opaque binaries,
  • alter security settings,
  • access credential stores,
  • use obfuscation or encoded payloads for no clear reason.

8) Rate limits and spend limits

• Cap CPU, memory, disk, runtime, and number of requests.
• Set network rate limits.
• Enforce API usage budgets and alerting.
• Kill long-running or looping agents automatically.

9) Supply-chain protections

• Pin dependencies and verify checksums where possible.
• Avoid letting the agent install arbitrary packages globally.
• Prefer read-only package caches and vetted registries.
• Scan downloaded artifacts before execution.

10) Data handling rules

• Clearly define what data the agent may access, copy, summarize, or store.
• Block it from moving sensitive data into third-party services.
• Redact secrets from prompts, logs, and outputs.
• Treat browser downloads and generated files as untrusted.

11) Separate environments

• Use different environments for:
  • browsing,
  • code generation,
  • code execution,
  • staging,
  • production.
• Never let an agent jump directly from internet access to production access.

12) A kill switch

• You need a way to immediately stop:
  • the process,
  • the container/VM,
  • network access,
  • any scheduled jobs or background tasks the agent created.

---

If you only remember 5 things

These are the most critical:

1. Sandbox execution
2. Default-deny network with allowlists
3. No production secrets
4. Human approval for sensitive actions
5. Full logging + easy kill switch

---

A useful rule of thumb

If the agent can:

• browse arbitrary sites,
• execute arbitrary code,
• and access credentials,

then you should assume it is capable of causing real-world harm unless constrained by design.

So the baseline should be:

• least privilege
• default deny
• short-lived access
• human approval for anything external or destructive
• strong isolation between the agent and anything valuable

If you want, I can turn this into a practical checklist for a local setup, a cloud deployment, or a policy document your team can adopt.