I Think I Need Two Computers
Contents
I'm building newsagent.fyi, an internet reader, with AI assistance. This post is about the security tradeoffs that keep me up at night.
I've been running AI coding agents for months now: Cursor, Copilot, Claude Code and Codex. The productivity gains are real, but I'm starting to think I need two computers. I don't mean one for work and one for gaming. I mean one that coding agents can access and one they can't.
Permission fatigue
Every time an agent wants to read a file, run a command or access something, it asks permission. That sounds safe. In practice, I give the agent a task, go make tea and come back expecting progress. Instead it's waiting: "Can I read this file?"
Of course it can. That's in the directory I told it to work in. So I press yes. Next time: "Can I run this command?" Yes. "Can I access this?" Yes.
I'm now conditioned to press yes. I want to let it do its job. The prompts are friction that slow down the work I'm trying to get done. 99% of the time the answer is obviously yes.
Eventually the answer should be no. Something will ask for access it shouldn't have, and by then I'll be in the habit of pressing yes.
What a sandbox blocks
The obvious solution is sandboxing. Restrict the agent to a specific directory. Don't let it touch anything else.
It also gets in the way of useful work.
Yesterday I was starting a new project. I said "look at this other Android project I built, understand the architecture, we're rebuilding it for a different platform." The agent went and scanned it, understood the patterns, came back ready to work.
In a locked-down sandbox I'd have to decide which files to copy in before the agent had seen the project. That puts the discovery work back on me.
An agent benefits from access to reference material, but access to every file on my computer is a poor way to provide it.
Skills and the supply chain
A friend sent me a tweet about skills. Skills are like plugins for agents. Someone wrote one, you install it, now your agent can do new things. Sounds great.
But think about what a skill actually is. It's instructions that tell the agent how to behave. It's code that runs with whatever permissions you've given the agent.
Example: someone writes a skill for creating a token on Solana. Lots of people want to do that. The skill asks you to configure the wallet address where proceeds should go. You enter your address. You run it. Code gets generated.
The code sends all the money to the skill author's address.
The skill gave you configuration theatre. It asked for your wallet address to make you feel in control. But the code it generated never checks that address. It's just hardcoded to the attacker.
The attack is hardly novel; it's a supply-chain scam adapted to agents. And now we're running code that generates code, using skills written by strangers, on machines that have access to our entire development environments.
The boundary I want
I want a clear boundary. This directory is fair game: read it, write it and run whatever you need without asking.
Outside that boundary, ask and give me enough context to make a real decision.
The current model is: ask about everything, teach user to say yes, hope they remember to say no when it matters.
A better model would define the boundary explicitly, grant full access inside it and block access outside it by default.
This is basically what sandboxes do, but with more granularity: full access to these folders and read-only access to another place where my reference code lives.
Physical separation
Until something like that exists, I keep coming back to physical separation.
One machine would hold email, banking, private documents and passwords. The other would hold code: projects and experiments that are fair game for whatever agent I'm running that day. I don't care if it reads the bootcamp course materials I wrote or experimental prototypes because there's nothing sensitive there.
Use something like Synergy or the native macOS screen sharing to flip between them. Never the twain shall meet.
This may be overkill, but I can't explain exactly where my current risk boundary is. The skills I'm using, the tools I've installed and the permissions I've granted while distracted have become a blur.
At least with two machines, the blast radius is contained.
The product question
There might be a product here: a permission manager for AI agents that thinks in terms of zones rather than individual prompts.
Define your zones: personal (locked), code (open), reference (read-only). Agent operates freely within its zone. Crossing zone boundaries requires explicit approval with clear context about what's being accessed and why.
Maybe somebody is already building it. If you know of it, tell me.
Until then, I'm looking at Mac minis.