An AI coding assistant that runs on your computer can usually read files in the project you give it, and, depending on settings, edit them, run commands and reach the internet. Permission modes and sandboxes limit this. The right setting is one you chose on purpose, not the default you never looked at.
TL;DR: Two controls matter. A permission mode decides when the tool must ask you first. A sandbox decides what the tool can technically do even if you say yes. Check both, keep them tight for new projects, and loosen them only for a reason.
Definition: sandbox. A sandbox is a fenced-off area in which a program runs with limited access, such as only one folder and no internet. If something goes wrong inside the fence, the damage stays inside it.
Why does this question matter?
A chat window cannot touch your files. A coding agent can. That one difference changes the risk.
If the tool can edit files, a bad suggestion becomes a bad change without a human copying it over. If it can run commands, a bad step can delete things, install software or send data somewhere. If it can use the internet, it can download code from a place you did not pick.
Most of the time none of this happens. The tool does what you asked. But security is about the day when something goes wrong, such as a confusing prompt, a mistaken command, or a trick hidden in a file the tool reads. On that day, the limits you set earlier decide how bad it gets.
If you need a refresher on the difference between chat tools and coding tools, read our post on Claude, ChatGPT, Claude Code and Codex.
What can the tool see?
By default, a coding tool is pointed at a working folder. It can read the files in that folder. That often includes things you forgot were there: notes, test data, configuration files and sometimes passwords saved in plain text.
A few simple habits shrink this:
- Open the tool in the smallest folder that does the job, not your whole home folder.
- Keep passwords and private keys out of project folders. Use a proper secrets store.
- Remember that anything the tool reads may be sent to the AI service as part of the request. Check your plan's data terms.
Our post on whether it is safe to paste code or secrets into an AI chat covers the sharing side.
What can the tool change or run?
This is where permission modes come in. Anthropic's documentation describes permission modes for Claude Code. A permission mode sets which actions the tool can take without asking you first.
The table below summarizes the modes as the Anthropic documentation lists them.
| Mode | What runs without asking | Suited to, per the docs |
|---|---|---|
| Manual (config name: default) | Reads only | Reviewing every action, sensitive work |
| acceptEdits | Reads, file edits and common file commands | Iterating on code you are reviewing |
| plan | Reads, plus some safety-checked commands | Exploring a codebase before changing it |
| auto | Everything, with background safety checks | Long tasks, fewer prompts |
| dontAsk | Reads and pre-approved tools only; anything else is denied | Locked-down automation |
| bypassPermissions | Everything | Isolated containers and virtual machines only |
OpenAI's documentation describes a similar idea for Codex with two layers. A sandbox mode decides what the tool can technically do, such as where it can write and whether it can use the network. An approval policy decides when it must ask you first. For the Codex command line tool and editor extension, the documentation says defaults include no network access and write permissions limited to the active workspace. In its Auto preset, Codex can read files, make edits and run commands in the working directory automatically, and it asks for approval to edit files outside the workspace or run commands that need network access. You can also switch to read-only mode with the /permissions command.
The documentation adds that destructive actions advertised by connected tools always require approval. That means a tool that says "this deletes things" gets a human check.
The names differ between products and change over time. The pattern stays the same: what may it do alone, and what must it ask?
What is the difference between asking and a sandbox?
People often mix these up, so here is a plain way to think about them.
An approval prompt is a polite question: "May I do this?" You answer yes or no. The risk is that after fifty prompts, people click yes without reading.
A sandbox is a locked door. Even if you say yes, the tool cannot go outside the fence. It does not depend on you reading carefully.
Good setups use both. The sandbox limits the worst case. The prompts keep you in the loop for the actions that matter.
Anthropic's documentation says bypassPermissions mode is meant only for isolated containers and virtual machines. In other words, skipping every check should happen only when the whole environment is a fenced-off area you can throw away.
How do you check your own settings?
Follow these steps once, then repeat them every quarter.
- Find the settings. Look in the tool's settings screen or its documentation page on permissions. Write down the current mode.
- Check the starting mode. Some tools start in a more automatic mode than you expect. Anthropic's documentation says that with recent versions auto mode is the starting mode for interactive terminal and VS Code sessions, so do not assume the default asks every time.
- Check the network setting. Can the tool reach the internet? If yes, is that needed for your work?
- Check the folder. Which folder is the tool working in? Is anything private in or near it?
- Check connected tools. If you have added connectors, such as a database or a ticketing tool, list what each one can do. Our post on Claude Code permission modes compared and our guide to Codex sandbox modes and approval policies are good next reads.
- Write it down. A short note with the date lets you spot changes later.
What does a worked example look like?
All numbers and names below are invented for illustration.
A developer, Priya, installs a coding tool and opens it in her home folder. Her home folder holds 4,000 files, including an old text file of passwords and a folder of client documents.
She runs the six steps.
- Step 2 shows the tool starts in a mode that auto approves most actions. She changes it to ask before edits.
- Step 3 shows network access is on. She turns it off for this project, because it only needs local files.
- Step 4 shows the tool can see 4,000 files. She moves her project into its own folder with 60 files and reopens the tool there.
After ten minutes, the tool can see 60 files instead of 4,000, cannot reach the internet, and asks before editing. Nothing about her work got harder. The worst case got much smaller.
What about tools that connect to other systems?
Coding tools can connect to outside systems through a standard called MCP, the Model Context Protocol. The MCP project describes it as an open standard for connecting AI applications to external systems, such as databases, search engines and design files.
Each connection adds abilities. A connected database might let the tool read customer records. A connected ticketing tool might let it create or close tickets. So treat each connection like giving a new colleague a new key. Decide what the key opens.
Our post on what an AI assistant can do through MCP shows a safe example with a read-focused tool.
Where does Safeguard fit in?
Safeguard offers an MCP Guardrail, which is a way to control what connected AI tools may do, and agent identity, which helps you track which agent took which action. These are for the connection and access side of this topic.
For the code side, Safeguard checks what ends up in your software. It builds a software bill of materials (a list of every component in an application), scans dependencies, and uses reachability analysis to show which flaws your code can actually trigger. Policies and gates can block pull requests that break your rules. Fix pull requests are available but off by default, with every category on Manual.
The Safeguard CLI runs on your machine and sends only scan results, not source code, to the platform. It can also write code, so the same permission questions apply to it: keep it in a small folder, review changes, and scan the result. Installers are on the download page, and the free scan is at gold.safeguard.sh/scan.
Try it yourself
Open the demo below and look at how the MCP Guardrail decides what a connected AI tool may do. Notice which requests are allowed and which are stopped.
Click through it at your own pace, or open it full screen.
Quick check
Can an AI coding assistant read every file on my computer?
Not by default in the tools described here. They work in a folder you choose, and permission settings limit what they do. Still, keep the folder small and keep private files out of it.
Is a permission prompt the same as a sandbox?
No. A prompt asks you for approval each time. A sandbox is a technical fence that limits what the tool can do even if you approve. Using both is safer than using one.
Is it ever fine to skip all permission checks?
Anthropic's documentation says its skip-everything mode is for isolated containers and virtual machines only. If the environment is not disposable, keep the checks on.
How often should I review these settings?
At least once a quarter, and whenever you update the tool, add a connector or change projects. Settings and defaults can change between versions.
Sources
- Claude Code permission modes, Anthropic documentation
- Codex agent approvals and security, OpenAI developer documentation
- What is the Model Context Protocol (MCP)?
- Safeguard downloads
Last reviewed: 19 October 2026.
