I use small local models regularly for coding. Worst I've seen is destructive git checkouts (can be fixed with git history) and maybe overwriting results of long regression tests unprompted.

This is the kind of thing where everything will be fine until it rm -rf:s everything you care about, and then you will be shocked that it never did that before. This has already happened publicly to hundreds of people, in private probably thousands. Be better than them and learn from the mistakes of others.

The actually sane default is to treat it like a junior trainee you would never trust with rights to anything critical. Use existing operating system facilities, namely user accounts and file permissions, to make everything it doesn't need protected from writes, and everything it shouldn't blithely broadcast to the world like private data and keys, also protected against reads.

> The actually sane default is to treat it like a junior trainee you would never trust with rights to anything critical

In my experience (mainly claude and Gemini argon, less so with gemini 3.1 pro), it's a bit worse. A junior dev won't hit "yes, delete" so confidently and think "I can just remake it" and proceed to ~~lie through its teeth~~ apologize 2 seconds later.

Completely agree with you. I primarily use AI coding agents within a container on a dedicated computer. I’d be annoyed if it somehow broke out of its container and managed to rm -rf /. I’d probably lose the last uncommitted changes, and have this setup the dev environment again. Nbd, but annoying.