Agent Security Audit: Full Filesystem Access Without Audit Trails

Run a quick experiment. Give your AI coding agent a task and then check what files it read during the session. Most frameworks do not log file reads at all. The agent had access to your entire home directory - SSH keys, environment variables, credential files, browser cookies - and there is no record of what it accessed.

The Current State

Most AI agents operate with the same filesystem permissions as the user who launched them. That means:

• Full read access to ~/.ssh/, ~/.aws/, ~/.config/
• Read access to browser profile directories (cookies, saved passwords)
• Read access to every file in every project directory
• Write access to the same

No audit log records which files were read. No alert fires when the agent accesses sensitive directories. If the agent's output goes to a cloud API, your credentials could be exfiltrated in the prompt and you would never know.

Git Stash Before Risky Operations

The minimum safety practice for file modifications is git stash before letting an agent make changes. This gives you a recovery point if the agent modifies or deletes files unexpectedly. It does not help with read-access concerns, but at least your changes are recoverable.

Better yet - run git stash automatically at the start of every agent session, and git diff at the end to review what changed.

What a Proper Audit Trail Looks Like

An agent security audit trail should capture:

• Every file read (path and timestamp)
• Every file write (path, timestamp, and diff)
• Every external API call (endpoint and payload size)
• Every shell command executed
• The agent's reasoning for each action

This data should be stored outside the agent's control (see: git as external audit store) and retained for at least 30 days.

Practical Steps Today

Until agent frameworks build proper auditing:

1. Run agents in a sandboxed directory - not your home folder
2. Use filesystem monitoring (fswatch on macOS) to log file access
3. Review git diffs after every agent session
4. Never give agents access to directories containing credentials
5. Use .gitignore patterns to prevent agents from reading sensitive files

The fact that this is not the default behavior for any major agent framework should concern everyone building with AI agents.

Fazm is an open source macOS AI agent. Open source on GitHub.

More on This Topic

• AI Desktop Agent Security Best Practices
• AI Agent Security Policy and Boundaries
• Protecting IP in AI Agent Projects