Agent Zero · main guide

Safety versus capability

Every setting that makes an agent more useful also gives it more ways to cause harm. That is not a flaw in any one product; it is what an agent is. A program that can tidy your files can also delete them, and one that can send a message for you can send the wrong one.

So the question is never "Is this setting safe?" It is "Is what I gain worth what I could lose, for this job, right now?" Each agent's page has a trade-offs section for its own settings. This page gives you the three questions to answer before you change any of them.

What it can reach

Start with what the agent could touch if it made a mistake or was tricked by a prompt injection. Think of it as rings:

Inside a container or one empty workspace: the worst case is losing files the agent made itself.
Your real files on the host: the worst case is losing or leaking your documents and photos.
Your accounts: email, cloud storage, social media, and shopping. The agent can now act as you, in public, to other people.
Your money: a bank, a card on file, or a paid API key with no spend limit.

Each ring outward multiplies the damage a single bad step can do. Widen the reach only when a job truly needs it, and only by one ring.

Can you undo it?

A mistake you can undo is an inconvenience. One you cannot undo is the real risk. A file in a backed-up folder can be restored, but a sent email, a deleted file with no backup, a public post, or a payment usually cannot.

Before you loosen a setting, ask whether you could recover if the agent got it wrong. If you can, the trade is often worth it. If you cannot, keep approvals on for that kind of action, or keep the agent away from it. When a mistake has already happened, use After it does something wrong before you change another setting.

Watching or unattended

An agent you are watching has you as its last line of defense: you can read each step, answer each approval, and press Stop. An agent running on a schedule, or answering chat messages while you are away, has no such check. Nobody is there to answer an approval, so it either stalls or proceeds on its own, depending on the agent.

Unattended work is where agents save the most time, and it is also where small mistakes grow, because they repeat until someone notices. Give unattended jobs less reach than you would give a job you are watching.

A ladder to climb one rung at a time

Most people find a comfortable level by moving up this ladder slowly, staying on each rung until it feels routine:

Watched, contained, no accounts. The agent works inside a container or one empty folder, you watch every step, and it has no logins. This is where every guide here starts.
Watched, with chosen files. You copy specific files into its workspace, or point it at one real folder you have backed up.
Watched, with the web. It browses and researches, but stays logged out of everything personal.
Unattended, low stakes. A scheduled job that only reads and writes its own notes, such as a daily summary of public news.
Reachable from your phone. A chat bot limited by an allow list to your own account, so you can send it jobs while away.
Accounts and money. Only with a dedicated account made for the agent, a spend limit set at the provider, and approvals on for anything that sends, posts, pays, or deletes.

If something surprises you on a rung, step back down one rung, work out what happened, and only then try again.

What does not make sense for a beginner

Some combinations put a lot at risk for little gain. Skip these until you know your agent well:

Your main email, bank, or payment accounts connected to an agent that runs unattended.
A chat bot anyone can message, with no allow list.
Turning off approvals while the agent can reach the host.
A paid API key with no spend limit on an agent that runs schedules.
Running the agent as an administrator. Every approval then becomes an administrator-level approval.

When more capability is the right call

Loosening settings is not reckless when the stakes are low and the gain is real. For example:

You are doing a big, boring job on files you have backed up, such as renaming hundreds of photos. Fewer approvals save an hour, and a mistake costs a restore.
The agent works only inside a container, so letting it run commands without asking risks only its own files.
You want a scheduled job that writes a daily briefing to its own folder. It reads public pages and touches nothing else, so letting it run unattended costs little.

The pattern is the same each time: the agent's reach is small, mistakes can be undone, or both. When neither is true, keep the safer setting.

Once Agent Zero has done useful work for a week or two, the power features are on Step 8: Advanced Agent Zero. Every other agent in this guide has its own advanced page, and setups that work with any agent are in the Advanced section.