The Cheapest AI Agent Sandbox on Windows: A Drive Letter

You dont need a VM, a container, or a sandboxed browser to stop AI agents from messing up your machine.

You need a drive letter.

Why it works

Windows filesystem permissions are already a sandbox. If an agent only sees drive Z:, it can only write to Z:. It cannot touch C:. It cannot read your SSH keys. It cannot delete your whole home directory.

Two tools

• Local folder mapping: subst.scsoi.com - point any folder to a drive letter
• Cloud/WebDAV mapping: drive.scsoi.com - mount cloud storage as a drive

Both are one-time purchases. No subscription. No per-seat license.

When to upgrade

If you need network isolation, dependency isolation, or Linux containers, go Docker or Firecracker. But if your only fear is "the agent will delete my files," a drive letter is enough.

Start cheap. Escalate when you actually need to.