Hah, I normally run it in a docker container myself, and only mount the project directory. Anything else it needs, I copy in for it, or occasionally I'll ask it to write an rsync.sh that I can run to bring in the stuff from outside.

I run it in bwrap so, even if I'm running on Linux, I don't pay the cost of some layered file system and building the docker image. I mount some directories read only, the project repos read write. A VM would provide more isolation but it's a matter of tradeoffs.

BTW, I just checked and my .gitignore files ignore .claude

Claude and any other program in my laptop could upload it anyway to any attacker controlled server. It's the usual threat analysis: who you want to defend against, what and the tradeoffs between cost of the defense and probability of the attack. Auto mode of not auto mode is in the cost of defense part IMHO.

[delayed]

This is exactly how my employer runs Claude. It gets r/w to the cwd and read only access to a bunch of whitelisted nfs. All web access goes through a proxy where internal resources are whitelisted

More than 10 million developers use Claude just fine without VMs or proxies.

The approach is hardly insane, even if you personally prefer additional safeguards.

10 millions developers doing something stupid does not make it right!

It's not stupid if it works and the supposed insane risk never manifests.

Tell that to everyone whose agents posted their secrets to GitHub.

Imagine that I am working at the AI company, and my friend has some bone to pick with you. My friend asks me to ask your AI agent to put some unsafe photographs/videos in your computer and do what ever necessary so that it looks like you put those files there.

Then my friends tips off the cops. And your life disappears! Gone!

And you didn't get a chance to share your story because I don't think you ll have wifi where you would be going, and frankly you are too clueless to imagine your AI agent doing something like that...