An AI desktop app can see whatever the operating system, the user and the app's own settings allow: folders you grant, the clipboard, the screen if permitted, and programs it can launch. Map each reach in a checklist, set the narrowest option, and test that the limit holds before you roll out.
Six surfaces to map
Files and folders. Does the app read the whole home directory, a chosen project folder, or only files you attach? Ask whether the scope is set by the user, by an admin, or fixed.
Clipboard. Some tools read the clipboard to be helpful. Clipboards often hold passwords and tokens for seconds at a time. Ask whether reading is on by default.
Screen and windows. Screen capture or window reading needs an operating system permission on most platforms. Ask when it is used, whether it is optional, and whether images are stored.
Commands and other apps. Can the assistant run shell commands, open apps or call local tools? Per OWASP, open ended extensions such as running any shell command carry large scope for unwanted actions, and narrower purpose built functions are safer.
Network. Which hosts does the app contact? Beyond the vendor, does it call plugin servers, local tool servers or third party services?
Credentials. Does it read environment variables, key files or browser storage? Secrets are the highest consequence item on a developer machine.
The checklist
| Surface | Question | Safer setting |
|---|---|---|
| Files | Which folders? | A named project folder, not home |
| Clipboard | Read by default? | Off, opt in per use |
| Screen | Needed? | Off unless the task requires it |
| Commands | Which allowed? | A short allowlist, ask on others |
| Network | Which hosts? | Vendor plus a reviewed list |
| Secrets | Env and key files visible? | Excluded paths, scoped tokens |
| Background | Runs when closed? | Only if the task needs it |
Pick one column to start with: the "safer setting" one. Loosen only for a named reason.
Verify, do not assume
Settings screens describe intent. Behavior is what counts. Run these checks on a test machine:
- Place a file named with a unique marker in a folder outside the granted scope and ask the assistant to find it. It should fail.
- Copy a dummy token to the clipboard, then ask a question unrelated to it. Check whether the token appears in the conversation or logs.
- Ask it to run a command that is not on the allowlist. It should ask or refuse.
- Watch outbound connections for a session and compare with the vendor's list.
Keep notes. They are also evidence for security questionnaires.
Default to least access
OWASP's mitigation advice for excessive agency is to minimize extensions, minimize their functionality and permissions, avoid open ended extensions, run actions in the user's context, and require user approval for high impact actions. For a desktop app, that translates into folder scoping, no clipboard or screen access by default, a command allowlist, and prompts for anything beyond.
Treat the machine as part of the boundary
If developers use the app on laptops that hold production keys, the app's reach includes those keys. Separate environments where you can, keep secrets out of the home directory, and use short lived credentials. An assistant cannot leak what it cannot read.
Safeguard's MCP Guardrail and policies give a second layer when the assistant reaches security tooling, and its asset discovery can help you find where agents and tool servers are running in your estate.
A worked example: a developer laptop
Consider a developer laptop with these items: a project folder, a home directory with a hidden folder of cloud credentials, a password manager that copies passwords to the clipboard, a chat app, and a terminal. A desktop assistant is installed with default settings. Walk the six surfaces.
- Files: the app asks for access to the project folder. The reviewer checks whether it can also read the home directory, including the credentials folder.
- Clipboard: reading is on by default. A password copied a second ago is visible to the app if it polls.
- Screen: off, until a task asks for it.
- Commands: the app can run shell commands after a prompt. The reviewer checks which are pre approved.
- Network: the app talks to the vendor and to two connectors.
- Credentials: environment variables hold a cloud token that the app inherits if it launches from the terminal.
Three items need a change: scope files to the project, turn off clipboard reading, and launch from a clean environment or remove the token. None needs the vendor to build something new. They are settings and habits.
Step by step: lock down a pilot machine
- Start from a clean user profile or a managed device image.
- Grant folder access to a single project folder.
- Disable clipboard and screen features unless the task needs them.
- Set commands to ask first, then add an allowlist for common safe ones.
- Exclude hidden folders and key files from any file access.
- Launch the app without cloud tokens in its environment, using short lived credentials fetched on demand.
- Run the marker file, clipboard and command tests from the earlier section.
- Capture the settings as a baseline and enforce them through device management.
What the permission prompts tell you
On most platforms, the operating system asks the user before an app can capture the screen or control other apps. Those prompts are a signal, not a guarantee. A user who clicks through everything gives the app broad reach. Part of rollout is teaching people that these prompts are decisions, and giving them a way to ask for help.
Review after updates
Apps change. After each major update, repeat the tests that matter, especially folder scope, clipboard and commands. Record the version tested. If a setting resets after an update, that is a finding for the vendor and a reason to pin versions until it is fixed.
Try it yourself
Click through it at your own pace, or open it full screen. Watch what the assistant is allowed to reach once a tool connection is configured.
Quick check
Does a granted folder include its subfolders?
Usually yes. Confirm it with the marker file test rather than assuming.
Is clipboard access really worth blocking?
Often yes. Clipboards frequently hold secrets, and few tasks need the assistant to read them unprompted.
What is the quickest way to reduce desktop app reach?
Scope folder access to one project, turn off clipboard and screen features, and set commands to ask first.
Sources
Last reviewed: 19 October 2026.
