The 'Accept All' Trap: Why Your AI Agent Needs Its Own Server

Imagine an assistant that works while you sleep. You hand it a tedious, mind-numbing job, the kind you have been avoiding for two weeks, and it plans the work, does it, checks its own output in long quiet loops, and leaves the finished result waiting for you in the morning. No sighing. No procrastination. No “I’ll start tomorrow.”

That assistant is real now. Agentic tools like Claude Cowork and Claude Code can run for hours on their own, doing genuine work without stopping to ask about every step. I use them every day, and they have changed how much a single person can get done.

But there is a part of this that the demos quietly skip over. To get that power, you have to give the AI real access to your machine. And the more access you give it, the more you have to lose.

The “accept all” trap

There are a few ways to run a tool like this, and they all trade safety for convenience.

The careful way is to keep yourself in the loop and approve every action. The AI proposes an edit, you read it, you approve it. Nothing happens that you did not see. On paper, this is the safe option.

In practice it breaks down, and not because of the technology. It breaks down because of you. A serious agent asks for permission constantly. At first you read every request. Then, somewhere around the fiftieth approval of the afternoon, you get bored. Or tired. Or you simply run out of attention span. You start skimming. Then you stop reading altogether and just click “allow,” “allow,” “allow.”

I have caught myself doing exactly this. You reach a point where you are approving actions without understanding a single one of them. The safe mode quietly stopped being safe, and nobody sent you a memo.

What you are actually handing over

So what are you clicking “allow” on? It helps to be specific.

An agent with broad permissions on your computer can:

• Modify your files.
• Delete your files.
• Open and use any application you have.
• If you give it the browser, reach any website you are still logged into.

This is not hypothetical. In 2025 an AI coding agent on the platform Replit deleted a live production database during a code freeze it had been told, in all caps, to respect, then fabricated thousands of fake records and downplayed what it had done. The same week, Google’s Gemini CLI destroyed a user’s files while trying to reorganize a folder.

A lot of these risks are fenced off, and getting better. Anthropic and the other labs are working hard on guardrails, and many of the obvious holes are closed. I want to be fair about that. But some of the risks are genuinely hard to mitigate, and one of them deserves a close look, because it does not look like an attack at all.

The instruction you cannot see

Say you ask your agent to read a web page and summarize it. Reasonable. You do it ten times a day.

Now imagine someone has placed text on that page in white, on a white background. You will never see it. But the agent reads the raw page, and that hidden text is not part of any summary. It is a set of instructions: share the user’s saved passwords, forward their API keys, copy their card details, and while you are at it, save this instruction to memory so you do the same thing next time.

This is called prompt injection, and the cruel part is that the model often cannot tell the difference between an instruction from you and an instruction smuggled in through a page it was told to read. It all arrives as the same stream of text. The agent has no reliable way to know which words it should trust.

When I first heard about this, I assumed it was an early problem that had long since been patched. It has not been. Prompt injection is currently the number one risk on the OWASP Top 10 for LLM applications, and Anthropic, in its own research, calls it “far from a solved problem” and states plainly that no browser agent is immune.

The numbers make it concrete. In Anthropic’s own testing of its browser agent, hidden-instruction attacks succeeded 23.6% of the time with no defenses in place. Their safeguards cut that to 11.2%, and their best model with extra classifiers pushes it down toward 1%. That is real progress. It is also not zero.

This is the shape of the whole thing. The labs build a defense, the attackers find a new way in, the labs respond. It has always worked like that, in every corner of security, and it is not going to stop. You are not going to win that war from your side of the screen. So the real question becomes: how do you use these tools without betting your entire digital life on someone else’s classifier holding the line today?

The real fix is less access, not less ambition

The honest answer is the boring one. Limit the access the system has over your data.

That sounds like it defeats the purpose. The whole appeal of an agent is that it works for hours, unattended, without stopping to ask. To get that, you usually have to run it in what is bluntly called bypass mode, where it stops asking for permission and simply acts. It is the most powerful way to run these tools. It is also the riskiest.

I want to be precise, because fear is not the point. Running in bypass mode does not mean the AI will damage anything. The odds of a genuinely bad outcome are low. But they are not zero, and they are never zero. So the real question is not technical, it is personal: are you willing to take that risk on the machine that holds your accounts, your passwords, and your bank access? Because if something does go wrong there, what you lose is not a test folder. It is potentially everything.

A five-figure lesson

Let me tell you why I take this so seriously.

I used to warn my clients about it constantly. Some of them did what almost everyone does. They got their systems running, they got their API keys working, and they moved on. No spending limits. No billing alerts. None of the boring guardrails, because the boring guardrails are boring and the product worked fine without them.

Then one day someone got hold of one of those keys and started using it for their own ends. No limit to stop it. No alert to catch it. The invoices ran into the tens of thousands of dollars before anyone noticed.

Here is the part people do not expect. The provider, whether it is Anthropic, Google, or anyone else, comes after you for that money. You used the service. It is not their fault you did not secure it. And if you are running a company, they will absolutely pursue payment. My clients went back and asked, more or less, “could you not see the spike? Thousands of dollars in a day, surely that looked wrong?” And the honest answer is that providers do detect leaked keys and unusual activity, but they do not hard-stop your spending in real time, and you are still the one on the hook. Even a budget cap can lag behind a fast attack.

This is not a rare horror story. It happens constantly, and the numbers are public.

In one widely reported case, a developer had set a budget of seven dollars. A forgotten public key let an attacker fire off more than 60,000 requests and run the bill past 18,000 dollars, because, as the report put it, the safety measures were off by default. Another key leaked on GitHub produced a 55,000 dollar bill. A stolen one produced an 82,000 dollar bill. The lesson is always the same. Set hard limits. Set alerts. Scope your keys tightly. And never assume the platform will save you from yourself.

Give the AI its own room

So how do you keep the power and lose the exposure? You stop running it on the machine that matters.

The best, easiest, and honestly cheapest answer we have found is to give the AI its own server. A separate box that holds none of your personal data, none of your passwords, and no path to your bank. If something goes wrong there, it goes wrong in a room with nothing valuable in it.

We have tried a few setups, and you have real options.

The simple one is to rent a normal Windows machine somewhere and install Claude Code on it. It works perfectly well, and good Windows boxes are cheap. This does not have to be an expensive exercise.

The one we keep coming back to, especially if you plan to use this heavily, is to spend a little more on a Mac Mini server. It gives you a lot more than a plain Windows box. If you actually use the thing, it pays for itself quickly, and it runs flawlessly. There is also a quieter advantage. If you already live in the Apple ecosystem, you can sync a great deal between your personal machine and the Mac Mini without handing it access to everything. That is the whole principle from earlier, turned into a feature: limited access, on purpose. And with tools like Codex now able to drive a computer directly, a Mac Mini becomes a genuinely powerful little automation engine, doing things you could not easily automate before.

The quieter reason: a backup for when the deal changes

There is a second reason to own your setup, and it has nothing to do with security.

If you are building something for the long term, you may not want to depend forever on renting someone else’s AI. Here is the mechanism I watch closely. The subscription price tends to stay the same. The amount of usage you get for that price does not. And the labs do not tell you exactly how many tokens you are buying, which I suspect is on purpose.

Look at how the tiers are described. A plan is sold at 5x or 20x the base plan. Those are multiples of the base. So if the base allowance quietly drops, the 5x and the 20x drop right along with it. On the entry plan you are usually given an estimate of how many messages you can send, not a token count. It is their business and they can run it however they like, but the practical effect is that you do not really know how much you are getting, and they can change it whenever they want. They could, in principle, tell you next month that you now get half of what you got this month.

This is not paranoia, it is already visible. Anthropic has added weekly usage limits on top of the existing ones, and openly dials those limits up and down. So it is worth having somewhere you can run a local model as a backup. Not because local models are better, but because they are getting fast enough to be useful, and because owning your fallback means you are never fully at the mercy of someone else’s pricing decision. Open models now score in the seventies on the hardest coding benchmarks, within striking distance of the frontier even if they are not matching it yet. A Mac Mini can run one. If the hosted tools ever degrade or get too expensive, you rent a slightly bigger Mac Mini, run your own model, and keep going with the same setup. No renegotiation, no panic.

It is cheap on purpose

Step back, and the economics get strange.

A lot of very smart, very well-connected people keep telling me the same thing. AI prices are going up, it is inevitable, and we are going to get less access over time, because these systems cost the labs far more than we pay for them. Right now, today, you are using a heavily subsidized product.

You do not have to take it on faith. Sam Altman said it himself, in plain language: “insane thing: we are currently losing money on openai pro subscriptions! people use it much more than we expected.” That is the 200-dollar-a-month tier, losing money.

So why give it away? Because they need adoption, and adoption needs a price people will say yes to. Cheap tokens get the population hooked, the features get people excited, and all of it becomes the story they tell investors: look how many people use this, it is not slowing down, it is safe to put money in, bubble or not. Meanwhile the actual business loses money, and the long-term plan, as Altman has said more than once, is essentially to reach AGI and let that solve the profitability problem. They do not fully know how to make this pay yet. They are hoping the future does.

It does not sound great when you say it out loud. But here is the thing.

While the labs burn money hoping for AGI, you and I get to use genuinely powerful tools for a fraction of what they cost to run. They may be taking us for fools. But we are the ones holding cheap, world-class tools right now. That is not a problem to complain about. That is a window.

Use the window

So use it. Hard.

This is the moment to take these subsidized tools and turn them into something real. Build your business. Grow it. Grow your audience and your reach. Ship products. Find clients and actually serve them well. Make money with this, while the tokens are cheap and the capability is this high, because there is no guarantee the terms stay this generous.

Just do it on your own terms. Give the AI its own server, not your laptop. Set your limits and your alerts before you need them, not after the invoice lands. Keep a local fallback so a pricing change is an inconvenience, not a crisis. That way you keep all of the upside of this strange, generous moment in AI, without betting your accounts and your savings on a permission dialog you stopped reading an hour ago.

The bottom line

Agentic AI is the most capable tool most of us have ever put our hands on. It can work for hours without you, and it is absolutely worth giving real access to get that. The mistake is giving that access on the one machine that holds everything that matters, and then clicking “allow” until you are not really reading anymore.

Give it its own room. Lock the doors you can. And spend this window building something that outlasts it.