Is it safe to let an AI coding agent run commands? A checklist

Short answer: yes, if you set limits first. Let the agent run safe, repeatable commands (tests, linters, builds) on its own. Keep secrets out of its reach, make it work on a separate branch, require your approval for anything that deploys, deletes or touches production, and review the diff before it merges.

Coding agents such as Claude Code, Codex, Gemini CLI and Cursor CLI do more than suggest code. They run shell commands, install packages and edit many files. That is what makes them useful, and it is also why a few guardrails matter.

Disclosure: we build Zokie, an agent IDE. This checklist applies to any agent, inside Zokie or not.

What can actually go wrong

• A destructive command. A wrong rm, a git push --force or a database reset run without asking.
• Leaked secrets. API keys in .env files that the agent reads, logs or pastes into a commit.
• Prompt injection. Text in a web page, issue or dependency that tells the agent to do something you did not ask for.
• Bad code that looks fine. A change that passes a quick glance but adds a security hole.
• Supply-chain risk. The agent installs a package with a lookalike name.

The checklist

1. Decide what runs without asking

Every major agent has a permission setting. Allow commands you run dozens of times a day, such as npm test or go test ./.... Keep approval on for package installs, git push, deploys, database commands and anything with sudo.

2. Keep secrets out of the working folder

Use your system keychain or a secrets manager instead of plain .env files where you can. If a .env file must exist, keep it in .gitignore and tell the agent in your CLAUDE.md or AGENTS.md never to read or print it.

3. One branch per task

Let the agent work on its own branch, ideally in its own git worktree. Your main branch stays untouched until you approve the change, and undoing a bad run is as simple as deleting the branch.

4. Never point it at production

Give the agent a local or staging database, never production credentials. If a task needs production data, export a sanitised sample.

5. Treat outside text as untrusted

Issues, web pages, logs and README files can contain instructions written for the agent. Be extra careful when a task asks the agent to read content from people outside your team, and keep approvals on for that session.

6. Check new dependencies

When the agent adds a package, check the name, the publisher and the download count before you accept the change. A lookalike name is a common trick.

7. Review the diff, every time

Read what changed, not what the agent says it changed. Look for new network calls, disabled checks, hard-coded keys and changes to auth or permissions. Our 10-point review checklist covers this in detail.

8. Keep a record

Know which agent ran which commands on which task. If something breaks next week, you want to find out what changed and why.

How Zokie handles this

Zokie runs the agents you already use (Claude Code, Codex, Gemini CLI or Cursor CLI) on your own machine and subscriptions. Every task gets its own git worktree and branch, the agent asks before risky commands, and you approve the diff before it becomes a pull request. Your code and files stay on your computer. For teams, guardrails written once are pushed to every seat, so a rule such as "never touch the payments folder" applies to everyone's agents. See Zokie for Teams.

FAQ

Can an AI coding agent delete my files?

It can run any command you allow. Keep approval on for deletes, force pushes and database commands, and let the agent work on its own branch so mistakes stay contained.

Should I give a coding agent my production credentials?

No. Use a local or staging environment with test data. Production access should stay with people and your deploy pipeline.

What is prompt injection in coding agents?

It is text hidden in an issue, web page, log or file that tries to give the agent new instructions. Treat outside content as untrusted and keep approvals on when the agent reads it.

Is it safe to use AI coding agents at work?

Yes, with the same care you would give a new contractor: limited permissions, no production access, a separate branch and a review of every change before it merges.