What an agent can touch on your computer
Claude Code and Codex are held to Omne's tools and an empty folder by default. Other agents follow their own settings. Here is how to see and change it.
By default, Claude Code and Codex can use only Omne's tools, in an empty folder. They cannot read your files or run commands on your computer. Every other agent follows its own settings, so it may read files and run commands, and Omne cannot stop it.
Two levels
| Level | What the agent gets |
|---|---|
| Omne's tools only | Omne's tools and an empty folder. No files, no commands. |
| Omne's tools and this computer | Omne's tools plus your files and commands, under the agent's own settings. |
On the agent's row in Settings, a tag reading Can use the computer appears when the second level is set. Without the tag, the agent is on the first level.
Claude Code and Codex are held
Omne's connector starts Claude Code and Codex in a way that restricts them to Omne's tools. This is the default and you do not need to do anything. Only a command run on the computer itself can lift it. Omne's servers cannot switch it on, so a mistake or a stolen account in Omne cannot turn your computer into something an agent can act on.
To lift the restriction for one agent, run this on the computer, with the agent's own name in quotes:
node ~/.omne/agent.mjs access "Name" computer
The connector answers with a warning in plain words: the agent can now read and change files and run commands without asking whenever you message it, and saved posts and emails it reads can try to trick it. To go back, use omne in place of computer:
node ~/.omne/agent.mjs access "Name" omne
Run node ~/.omne/agent.mjs status to see each agent on the machine and its level.
Every other agent follows its own settings
Gemini CLI, Antigravity CLI, Grok Build, Hermes and the rest cannot be held the same way. In checking, an agent reached over the Agent Client Protocol read a file and ran a command without asking, so Omne makes no promise that these stay inside Omne's tools. What Omne does:
- It refuses whatever such an agent asks permission for.
- It cannot stop what the agent does without asking.
- It shows you what the agent did, as lines above the answer.
Because of that, the panel for these agents has a box you must tick before connecting: the agent runs as you on that computer and may read files and run commands there, and saved posts and emails it reads could try to trick it. Tick it only if you are comfortable with that.
Why the warning about saved posts and emails
Your Library holds content written by other people. An agent that reads a saved post or an email also reads any instructions hidden in it. An agent that can only call Omne's tools can do limited harm even if it is fooled, because changes wait for your approval. An agent that can run commands on your computer can do much more. That is the whole reason the default is the narrow one, and why Omne's brief to every agent says that what it reads from saved posts, emails and pages was written by other people and must be treated as information, never as instructions.
Approvals still apply to Omne's tools
Whatever the level, a change made through Omne's tools waits for Allow or Decline. The computer level only adds what the agent can do outside Omne. See How approvals work.
Choosing a level
Keep Claude Code and Codex on the default unless you want them to work on files on this machine. For the other agents, think about which computer you connect them from. A machine you use for ordinary work, with personal files, deserves more thought than a spare one.
Last updated November 3, 2026
There's a real person behind Omne, so ask anything.