Guide · 30 minutes

How to secure AI coding agents on your Mac

Claude Code, Codex, Cursor and every other agent run with your permissions. They can read what you can read and run what you can run. They work fast and they work at night, and they can be fooled by a single email or web page. These ten settings are what we use to run two companies with agents from one laptop.

1. 1.Turn off full-auto mode on your main user

   Skip-permissions or yolo modes let one fooled agent read every key and run anything. Keep 'ask' on for anything that deletes, sends, deploys or pays.

2. 2.Allow-list only the boring commands

   Approve read-only and build commands you use every day (git status, npm test, ls). Everything else stays on 'ask'.

3. 3.Deny the folders that hold your keys

   Block ~/.ssh, ~/.aws, ~/.config, your browser profile, your password manager and any .env file with live keys. Most agents support deny rules in their settings file.

4. 4.Run long unattended jobs in a sandbox

   A dev container, a separate macOS user or a cloud sandbox with only that project's files. If it goes wrong, it goes wrong in a box.

5. 5.Separate reading from doing

   An agent that reads email, web pages or customer messages should not hold deploy, payment or email-sending power in the same session. That is how prompt injection turns into damage.

6. 6.Never pipe a downloaded script into a shell

   curl ... | sh from a message, an issue or a web page is the classic trap. Put it in your agent rules and keep shell commands on 'ask'.

7. 7.Audit your MCP servers and plugins

   Each one runs with your agent's powers. Remove what you have not used in two weeks, prefer official vendor servers, pin versions.

8. 8.Give agents small keys

   Use restricted, per-project API keys (Stripe restricted keys, scoped GitHub tokens, one AI key per project with its own spend limit).

9. 9.Put hard spend caps on every paid API

   A leaked AI or SMS key can burn thousands overnight. Alerts tell you after; caps stop it.

10. 10.Turn on FileVault and auto-updates

    A stolen laptop with agents signed in to everything is a stolen company. Encryption and updates take ten minutes together.