Top AI Product

If you’ve been letting Claude Code, Codex, or Aider run loose on your machine, you’ve probably had that moment — the one where you realize your coding agent has full access to your SSH keys, your `.env` files, and every repo on your system. It’s a weird feeling, like handing your house keys to a very smart but occasionally reckless intern.

[Agent Safehouse](https://agent-safehouse.dev/) is a new open-source tool that tackles this head-on. Built by [eugene1g on GitHub](https://github.com/eugene1g/agent-safehouse), it uses Apple’s built-in kernel-level sandboxing (`sandbox-exec`, also known as Seatbelt) to lock down AI coding agents so they can only touch the project directory you point them at. Everything else — your `~/.ssh`, your other repos, your global configs — is off-limits. The kernel blocks the syscall before anything even gets read, which means even a rogue agent with elevated privileges can’t sneak past it.

What I really like about it is the philosophy: deny everything by default, then whitelist only what the agent actually needs. That’s the opposite of how most of us run these tools today, where the agent just inherits all your user permissions and hopes for the best. The setup is absurdly minimal too — it’s a single shell script, no dependencies, no Docker, no VM overhead. You download it, make it executable, and wrap your agent command with it. That’s it.

The project [blew up on Hacker News on March 8](https://news.ycombinator.com/item?id=47301085), pulling in 403 points and over 90 comments. A lot of the discussion centered on whether macOS sandboxing is robust enough compared to containers or VMs, and the general consensus seemed to be that for the “keep my agent from accidentally nuking my dotfiles” use case, it’s more than sufficient. Several Spanish and English tech blogs picked it up too, which tells you the timing is right — as AI agents become a daily driver for more developers, the “what can this thing actually access?” question is getting louder.

If you’re on macOS and running any kind of local coding agent, Agent Safehouse is worth the five minutes it takes to set up. It won’t slow your workflow down, and you’ll sleep a little better knowing your agent isn’t quietly reading files it has no business touching.

You Might Also Like

• Claude Code Security Just Dropped and it Already Found 500 Zero Days Nobody Knew About
• Claude Code Remote Control Just Turned my Phone Into a Coding Terminal and im Weirdly Into it
• Obra Superpowers Turned my Claude Code Into a Proper Engineer and im not Going Back
• Claude Context Mode Might be the Best Thing Thats Happened to my Claude Code Sessions
• Agent Builder by Thesys When ai Agents Stop Talking and Start Showing