@Jordan Shaw Lets Go!!!!

@David Vogel Thank you my friend! ☺️🙏🤓

@Jeff Van Leenen congratulations! Well deserved! 🙌😊🏆

Hi @Alessandra Turati sorry for the delay here!Short answer: the VM is a real safety layer, but it isn't a guarantee. It's worth setting things up so a failure wouldn't hurt you. What the VM does: In local mode, the agent runs inside a Linux virtual machine as an unprivileged user. Local file access is limited to the folders you've connected in the desktop app, and each local tool call is checked against those permissions. The caveat: In July, Accomplish AI researchers showed that a local session could exploit a Linux kernel flaw to get root inside the VM, and from there reach the Mac's filesystem through a writable mount. They connected one folder, and the agent then read and wrote files outside that folder without another permission prompt. That's close to your exact scenario. Anthropic rated the report as informative and didn't ship a specific patch. Note: the newer versions run in the cloud by default, so this local-VM escape is no longer the default path. A cloud session only reaches your local files through the desktop app, only for folders you've connected, and only while the app is online. What I'd do in your setup: - Close decrypted volumes first. Unmount them before running a session, especially one in local mode. That's the biggest risk in what you described. - Use a dedicated folder. Make a folder that holds only non-sensitive working files, and connect that instead of a broad Dropbox folder. - Skip Full Disk Access. Some Dropbox/OneDrive troubleshooting guides tell you to grant Claude Full Disk Access. That gives the app much wider reach than you need. - Know that changes sync. Anything Claude edits or deletes in that Dropbox folder syncs everywhere. Dropbox version history is your undo button. - Watch what it reads. Only have it read files you trust, since instructions hidden in a document can steer an agent. We learn together, we grow together, we win together. 🙌

@Alessandra Turati Great question. The honest answer starts with a caveat: you can't filter prompt injection the way you filter SQL injection. With SQL, there's a clean fix. Parameterized queries separate code from data, so the database always knows which part is a command and which is just a value. Untrusted input literally can't cross into the instruction channel. A language model has no equivalent, because it has only one channel. Instructions and data both arrive as text, and the model decides what to act on by meaning, not by structure. There's no syntax that marks something "data only, never obey it." In fact the UK's National Cyber Security Centre argues prompt injection may be harder to solve than SQL injection ever was. OWASP ranks it the #1 risk for LLM apps and says outright there may be no foolproof prevention. So you can't sanitize your way out — the goal is to contain it, not eliminate it. That means "watching what it reads" is really about containment. A few habits: Break the combo. An injection needs two things at once: the agent reads content you don't trust, and it can take actions that hurt you. Remove either one and the attack has nowhere to go. Read the unknown file in one session; do your trusted edits in another. Keep approvals on. Skip "Act without asking" “Bypass Permission” settings when untrusted content is involved. Each approval pause is your chance to catch something off. Watch the steps. If you asked for a summary and it suddenly wants to open other folders, send something, or delete files, stop. That mismatch is the tell. Never auto-approve deletions. The app asks before permanently deleting. Treat that as a real checkpoint. Limit the web. If it browses, allow only sites you trust — web pages and emails are the most common place for hidden instructions. Be picky about add-ons. Only install plugins from sources you trust; some run with far more access than the agent itself. Pre-screen. Skim outside files yourself first, or paste just the text you need instead of handing over the whole thing.

@David Vogel

@David Vogel It takes a village my friend!

@Jeff Van Leenen 🏆 This is a great way to battle scope creep. In my experience my best ideas are always built with intention, and keeping my sessions scoped to their focus has proven to be a strong building habit for me. When I first started building with AI, I created a dashboard, the dashboard was accessible by my AI & I. After scoping out an idea, we would chunk a build into features, each feature got a check box on the dashboard, as we progressed through the build AI AND myself had to approve a task was completed, we would check off the tasks once we agreed it completed. The dashboard eventually evolved a "Parking lot" for the ideas that inevitably pop up while you're building! Inspiration does not have a date or time! I love this idea and think it will absolutely help with building, scope creep, follow through and ultimately development. ☺️💪🏆 Brilliant work here!