AI coding agents operate directly on users' filesystems, where they regularly corrupt data, delete files, and leak secrets. Current approaches force a tradeoff between safety and autonomy: unrestricted access risks harm, while frequent permission prompts burden users and block agents. To understand this problem, we conduct the first systematic study of agent filesystem misuse, analyzing 290 public reports across 13 frameworks. Our analysis reveals that today's agents have limited information about their filesystem effects and insufficient control over them. We therefore argue for shifting this information and control to the filesystem itself. Based on this principle, we design YoloFS, an agent-native filesystem with three techniques. Staging isolates all mutations before commit, giving users corrective control. Snapshots extend this control to agents, letting them detect and correct their own mistakes. Progressive permission provides users with preventive control by gating access with minimal interaction. To evaluate YoloFS, we introduce a new methodology that captures user-agent-filesystem interactions. On 11 tasks with hidden side effects, YoloFS enables agent self-correction in 8 while keeping all effects staged and reviewable. On 112 routine tasks, YoloFS requires fewer user interactions while matching the baseline success rate.

翻译：AI编码智能体直接操作用户的文件系统，经常导致数据损坏、文件删除和机密泄露。当前方法在安全性与自主性之间强制权衡：无限制访问存在风险，而频繁权限提示则加重用户负担并阻碍智能体运行。为理解该问题，我们首次系统性地研究了智能体文件系统误用行为，分析了来自13个框架的290份公开报告。分析表明，当前智能体对其文件系统操作的影响了解有限、控制能力不足。因此，我们主张将信息与控制权转移至文件系统本身。基于这一原则，我们设计了YoloFS——一种面向智能体的原生文件系统，包含三项技术：暂存机制在提交前隔离所有修改，赋予用户修正性控制；快照机制将控制权扩展至智能体，使其能够检测并修正自身错误；渐进式权限通过最小化交互的访问控制为用户提供预防性控制。为评估YoloFS，我们提出了一种捕获用户-智能体-文件系统交互的新方法。在11项包含隐藏副作用的任务中，YoloFS使智能体在8项任务中实现自我修正，同时所有操作保持暂存与可审查状态。在112项常规任务中，YoloFS在匹配基线成功率的同时减少了用户交互次数。