Your AI Coding Agent Should Not Run as You

Recently a viral post on X lamented that GPT-5.6 Sol accidentlly deleted most of the files in a user home directory. Running in full-access mode with the sandbox off, a review subagent mis-expanded $HOME and ran rm -rf <user home>.

Many people offered solutions to avoid this, from sandboxing from hooks, but one measure that is as old as software development has never been mentioned: you don’t develop and run your life activities with the same account. I remember people swearing by this principle since I started as a Software Engineer in the late 90s.

How to do it on Mac OS - it’s really simple

Step 1: Create a developer user

System Settings > Users & Groups > Add User > Standard

• Enter user details
• Keep the new user in the same group (the default is staff)

Step 2: Share the code

Both users have private homes, so put the code somewhere both can reach. /Users/Shared works

Step 3: Lock your own home

For your everyday user:

chmod 700 /Users/yourname

This will make your files unreadable to any other user. The developer account gets “Permission denied” on your files.

Note that you can’t do with the Finder interface (even if you can give write-only Dropbox permission to the staff group, which should equally work)

What it does and does not protect

The developer user cannot read your personal files, browser sessions, mail, or keys, and being standard it cannot sudo or install system-wide packages.

It does not protect the shared code itself: the same rm -rf would still delete everything in /Users/Shared/, so you must use git to version control all your code.

The solution does nothing about network access either. A second user is the cheapest boundary, not the strongest; a VM or a second machine is stronger.

Again, this is one security measure. It’s not the solution to everything, but it should be the first layer of security