Can I let Claude Code run 'rm -rf' safely? The sandbox trick that makes it possible

TL;DR

• Giving an AI agent root access to your real machine is dangerous; the root filesystem is wide open to accidental or malicious destruction.
• An Agent Shell box (xshellz.box) gives the agent fake root inside a gVisor sandbox: the box's own root filesystem is ephemeral and only /home persists across reboots.
• Every xshellz.box ships with Claude Code, borg, and two other coding agents preinstalled, so you can hand any agent a disposable root environment in seconds.

No, not on your real machine. You can give an AI agent safe root access only if you hand it a hardened, ephemeral sandbox that discards its own root filesystem on every reboot. We run these boxes at scale on the xShellz fleet, and they survive rm -rf / without a scratch. Here is exactly how the Agent Shell turns a destructive command into a no-op on your host.

is it safe to give an AI agent root access to my terminal?

No. An AI agent running as root on your laptop has no guardrails; a stray rm -rf / or an overzealous file search can wipe your entire disk. Root can read and delete anything, hop to other services, and load kernel modules. The only safe way is to give the agent an isolated environment where "root" is actually a fake root inside a container with no access to your real hardware. That is what the Agent Shell provides by pairing user namespace remapping with a hardened gVisor sandbox.

how do I give an AI agent a safe sandbox to run commands?

Spin up an Agent Shell box, connect via SSH (ssh -p <port> root@<host>), and run your coding agent inside it. The box uses user namespace remapping and a gVisor sandbox to fake root: the agent sees a full Linux root, but every operation is trapped by gVisor and the box's own root filesystem is a throwaway layer that resets on reboot. Only /home persists. You can also log in through the browser web terminal; no key needed.

what is the difference between a VPS and a gVisor sandbox for AI agents?

A standard VPS gives you real root on a shared kernel, so a misbehaving agent can still mess with kernel modules, escape the namespace, or exhaust host resources. A gVisor sandbox, as used by the Agent Shell, runs a user-space kernel that intercepts every system call and applies its own security rules. Paired with Linux user namespace remapping, the agent gets a root that is translated to an unprivileged user on the host. This double isolation means the box's root filesystem can be erased entirely and the host remains untouched.

can an AI agent break my host machine if it has root access?

Yes, trivially. On a real machine, root can delete filesystem entries, rewrite boot sectors, load kernel modules, and pivot to other network services. Even inside a container with real root, a breakout to the host is possible unless additional hardening like seccomp and user namespaces are in place. That is why the Agent Shell never gives an agent real root; the fake-root model and gVisor sandbox ensure that any filesystem damage is confined to the ephemeral root layer. A full rm -rf / --no-preserve-root inside the box only wipes the sandbox, not your host.

how to set up a hardened linux box for Claude Code or borg

Create an xshellz.box and ssh in. The box is preinstalled with Claude Code (claude), borg, OpenAI Codex (codex), and Gemini CLI (gemini). Simply invoke your agent, for example, borg "fix the failing test" or claude. Because the underlying system is Ubuntu 24.04 with Node 22 and Python 3 already installed, agents can run builds and tests without extra setup. The root environment is wiped on reboot, so after a session you can reboot to a clean state or keep /home for permanent files. With borg, use borg learn to generate a context file that repopulates your setup after a reboot.

Frequently asked questions

Can I use the Agent Shell with OpenAI Codex or Gemini CLI too?

Yes. Every Agent Shell comes with OpenAI Codex (codex) and Gemini CLI (gemini) preinstalled alongside borg and Claude Code. You can run any of the four agents in the same sandbox without installing extra software.

Is the free tier really always-on?

As of July 2026, every Agent Shell tier (including the free tier) is always-on with no idle timeout and no trial countdown. You can keep a box running permanently for continuous agent tasks.

How do I keep my files between sessions?

The root filesystem is ephemeral and reset on every reboot, but the /home directory persists. Any files you want to keep (code, dotfiles, scripts) should live in /home. You can also reproduce your setup with an xshellz.box manifest in your home directory.