Try Turborg Free → Open App →
← All posts

Can I let Claude Code run 'rm -rf' safely? How to sandbox your AI agents

July 31, 2026 · 4 min read · The xShellz Team

TL;DR

  • An AI coding agent with shell access can delete your files if run on your own machine; never run it outside a sandbox.
  • xShellz Agent Shell boxes give the agent real root inside a fake-root sandbox (gVisor + userns-remap) that can’t touch your host.
  • Every box is always-on, free tier included, and preloaded with Claude Code, Codex, Gemini CLI, and borg.

No, it is not safe to let a coding agent run commands directly on your own computer. The agent has full shell access, and one misunderstood prompt can delete your home directory. We build and operate xShellz: the borg terminal agent, the Agent Shell boxes and the hosted model gateway behind them. Everything below is what we run in production ourselves, not a demo.

is it safe to let an AI coding agent run commands on my computer?

No. An agent like Claude Code or Gemini CLI runs as your local user, with the same power you have. It can create, modify, and delete any file you own. There is no safety net: the model may misinterpret an ambiguous instruction and issue rm -rf /home/$USER/* while meaning to clean a build directory. If you work on a local machine with important projects, one wrong token can be catastrophic. The agent has no concept of what is valuable to you; it only sees the file tree you gave it access to.

how do I run claude code in a safe sandbox?

Spin up an Agent Shell box and connect via SSH for a full remote session. If you want to keep your local editor but shift all terminal risk to the sandbox, use the Model Context Protocol to wire the box as an MCP server:

claude mcp add xshellz -- ssh -p 2222 [email protected] xshellz-mcp

Now any tool call from your local Claude Code goes through SSH into the hardened box. The agent still thinks it is running root, but every command is contained inside the sandbox.

can an ai agent delete my files if i give it terminal access?

Yes, if you run it locally. It gets your real uid and gid, and it will happily rm anything you have permission to delete. Inside a hardened box, the answer changes: the agent gets what looks like real root, but it is mapped to an unprivileged user on the host. The box’s root filesystem is discarded on every reboot, and only /home persists. So the agent can delete files within the sandbox, but it cannot reach your laptop’s drive. Reboot the box if needed and you get a clean slate.

what is a hardened linux box for ai agents?

An xShellz Agent Shell box is an always-on Ubuntu 24.04 LTS container that runs under gVisor, a security-focused application kernel that intercepts system calls and enforces a tight sandbox. Inside, root is mapped via Linux user namespaces so the agent thinks it has full control, while the host sees it as an unprivileged uid. The root filesystem is ephemeral; only /home survives a reboot. The box ships with Node 22, Python 3, git, build-essential, and four coding agents already installed, so you don’t waste time provisioning.

how to set up a remote dev environment for ai coding agents

Create an Agent Shell box from the xShellz dashboard and choose a plan (free tier is always-on, no idle timeout). Once provisioned, connect via SSH using the assigned port and root user. You can define an xshellz.box manifest file in the home directory to reinstall extra packages on every boot:

# xshellz.box - one package per line
pip:torch
npm:typescript
apt:htop

The manifest runs at boot, so every box gets the same environment. All four agents are ready to use: claude, codex, gemini, and borg. Run your coding session, and no matter what the agent does, your local machine is never in danger.

Frequently asked questions

Does a free box stay on all the time?

Yes. Every Agent Shell tier is always-on, including the free plan. There is no idle timeout and no trial countdown. You keep the box as long as you need it; stopped boxes are kept for 30 days before cleanup.

What happens if the agent crashes the box?

The sandbox keeps the crash contained. The root filesystem is ephemeral, so a reboot restores the box to its initial state except for the persistent /home directory. You can reconnect and resume work in a minute.

Can I use my own API keys with Claude Code inside the sandbox?

Yes. The box runs a standard Ubuntu environment, so you set ANTHROPIC_API_KEY or any other environment variable exactly as you would on a local machine. Keys stay inside the sandbox and are not exposed to the host.