Downloads

AI agent machine hardening guide

Give the agent its own machine, network and accounts, so a mistake cannot reach yours. A free ten-page guide with a checklist to print.

A free ten-page guide and checklist for setting up a dedicated Mac for an AI agent: its own network, its own accounts and its own identity, so a mistake stays inside it.

Version

1.1

Published

26 October 2026

Checked

26 October 2026

An agent that works for you needs a computer to work on. Most people give it their own: their network, their Apple ID, their browser with everything already signed in. Then whatever the agent can reach is whatever you can reach.

Why this exists

An agent does not need to be malicious to do damage. A wrong guess, a bad instruction hidden in a web page, or a sign-up it decided to make is enough. Three ways it goes wrong on a shared setup, each taken from the guide’s threat table and none of them a report of a real case:

• It opens your mail. The browser on the machine is signed in to your Gmail, or iCloud Keychain has synced your passwords. The agent reads and acts in your name.
• It finds the rest of your network. On the same network as your NAS, printer or smart-home devices, one wrong command can touch them.
• It signs up for things you do not know about. Agents create accounts, accept terms and start trials. Without a weekly look, you lose track of what exists.

Each one is prevented by a setting, and the guide gives the setting for each, plus a check you can run to see that it holds.

What you get

One PDF of ten pages, written for a Mac Mini and usable on any computer:

• A threat table of seven risks, with what could happen and which section deals with it.
• Seven common mistakes, from using your personal Apple ID to never reviewing what the agent created.
• A table of which layers you need, in three columns: experimenting, building a product, and handling client data.
• Eight short checklists: network isolation, a dedicated Apple ID, user accounts, disk encryption, the firewall, separate accounts for the agent, setting up the agent, and a weekly review.
• A quick reference page of 19 items to print and tick off.

How it works

The idea is one sentence: the agent gets its own world, with its own network, accounts and identity, and can do anything inside it and nothing outside. You do the work in the order of the sections. Network isolation comes first, because it is the layer people skip, and each checklist ends with something to try, such as pinging your own computer from the agent’s machine, which must fail.

The test at the end of the account section is the one to keep: if every account and password on this machine were leaked tomorrow, what would be affected? The answer should be only the agent’s own domain and services.

Which setup you need

The guide’s table sorts the layers by what you are doing. For an experiment, a standard user account and separate accounts are required, and the rest is recommended or optional. For a product, every layer is required except the weekly review, which is recommended. When the agent handles client data, the weekly review is required too. If you are unsure which column you are in, take the stricter one.

Check before you rely on it

I wrote the guide in March 2026 and have not changed it since. Four things to know before you follow it:

• Two steps cannot both be followed on a Mac. Section 3 says to turn on automatic login so the machine resumes after a restart. Section 4 says to turn on FileVault. Apple’s documentation says that when FileVault is turned on, automatic login is disabled. With FileVault on, a restart waits at the login screen for a password. You have to choose: encryption on the disk, or a machine that comes back by itself after a power cut. Decide which matters more for your setup and write it down.
• It tells you to turn off Find My Mac. The aim is to keep the agent’s Apple ID separate from yours. It also removes the way to locate or lock a stolen machine. Consider whether you want that trade.
• Menu names move. The paths to the settings are those of March 2026. Apple renames and relocates them between macOS versions, so use them as a pointer and not as a script.
• One cross-reference is off. The threat table sends you to Section 5 for account separation. It is Section 6.

Where it stops

The guide is about the machine and the identities around it. It does not say what the agent itself may do inside its own world: which API keys it holds, what they can spend, or whether it can reach a payment method. If the agent will touch money, the Banking Agent Assessment is the companion: it covers limits, approvals and who answers for a payment.

It is not security, legal or IT advice. If the machine will hold client data or you work in a regulated industry, have a qualified person review the setup. The guide says the same on page 2.

Using and sharing

Free, no sign-up. The guide is licensed under Creative Commons Attribution 4.0 (CC BY 4.0): you may share it and adapt it for any purpose, including commercial use, if you give credit, link the licence and say what you changed. The attribution line to use is printed on page 2 of the guide. The licence in the guide applies to it, and clause 9 of the terms of use says so. The rest of the terms, including the disclaimers, apply to the guide as well.