AI coding agents operate directly on users' filesystems, where they regularly corrupt data, delete files, and leak secrets. Current approaches force a tradeoff between safety and autonomy: unrestricted access risks harm, while frequent permission prompts burden users and block agents. To understand this problem, we conduct the first systematic study of agent filesystem misuse, analyzing 290 public reports across 13 frameworks. Our analysis reveals that today's agents have limited information about their filesystem effects and insufficient control over them. We therefore argue for shifting this information and control to the filesystem itself. Based on this principle, we design YoloFS, an agent-native filesystem with three techniques. Staging isolates all mutations before commit, giving users corrective control. Snapshots extend this control to agents, letting them detect and correct their own mistakes. Progressive permission provides users with preventive control by gating access with minimal interaction. To evaluate YoloFS, we introduce a new methodology that captures user-agent-filesystem interactions. On 11 tasks with hidden side effects, YoloFS enables agent self-correction in 8 while keeping all effects staged and reviewable. On 112 routine tasks, YoloFS requires fewer user interactions while matching the baseline success rate.

翻译：AI编码智能体直接操作用户的文件系统，常常导致数据损坏、文件删除和机密泄露。当前的方法在安全性与自主性之间强制折中：无限制访问会带来风险，而频繁的权限提示则给用户带来负担并阻碍智能体。为理解这一问题，我们开展了首个关于智能体文件系统误用的系统性研究，分析了13个框架中的290份公开报告。分析表明，当前的智能体对其文件系统影响的信息有限，且缺乏足够的控制能力。因此，我们主张将信息与控制权转移给文件系统本身。基于这一原则，我们设计了YoloFS——一个面向智能体原生的文件系统，采用三种技术：暂存区在提交前隔离所有变更，赋予用户纠正性控制；快照将这种控制扩展到智能体，使其能够检测并纠正自身错误；渐进式权限通过最小化交互的门控访问，为用户提供预防性控制。为评估YoloFS，我们引入了一种新的方法，用于捕获用户-智能体-文件系统的交互。在11个带隐藏副作用的任务中，YoloFS使智能体在8个任务中实现自我纠正，同时所有变更保持暂存且可审查。在112个常规任务中，YoloFS在匹配基线成功率的同时，减少了用户交互次数。