The most easily overlooked risk when an AI agent executes commands on a computer or calls a local model is excessive permissions. Terrarium puts each agent inside an isolated virtual machine and requires administrators to approve file and network access item by item. This direction deserves attention because what enterprises and developers often lack when deploying agents is not a smarter model, but an auditable boundary for execution.
What this is
Terrarium is an open-source tool for local execution. It creates a persistent Linux virtual machine for each AI agent, placing the tools and scripts invoked by the agent in the same isolated environment. Administrators use YAML recipes to specify which directories the agent may read and write and which network addresses it may access; all other requests are blocked by default.
Unlike containers that share the host kernel, each environment has its own kernel. Network connections are inspected by a separate proxy outside the virtual machine. The project does not require a persistent background service, and the same configuration works on Linux, macOS, and Windows. It is still in testing.
Industry view
We believe Terrarium has identified the most practical lesson in enterprise agent deployment: a model's ability to complete a task does not mean it can be trusted with access to the host machine. File scopes, access targets, and operation logs can all be encoded in configuration. That is more verifiable than merely prompting a model not to perform dangerous actions, and it is better suited to compliance review.
But the risk has not disappeared. Developer-approved directories may still be deleted, supplied credentials may still leak, and authorized websites may still receive data. Terrarium does not yet support CPU, memory, or disk quotas, and the security promises of its test build require further independent validation. What it demonstrates is that least privilege can be made clearer—not that running an agent is already safe.
Impact on regular people
For enterprise IT: Companies can begin by letting agents handle low-risk tasks such as code cleanup and document retrieval, then progressively connect them to internal systems without opening access to the entire computer or corporate network from the outset.
For individual professionals: Local agents can handle sensitive files with less need to upload them to the cloud, but users must still verify directory and network permissions before use. An isolated environment is not a waiver of responsibility.
For the consumer market: Desktop agents may evolve from chat tools into assistants that actually perform tasks. The trade-off is that computers will need to store more runtime environments and permission records, while users will bear the risk of incorrect operations more directly.