Should coding agents isolate dependency setup by default?

AI coding agents that can install dependencies and run project scripts should, in my view, start dependency setup in a network-isolated, consent-based mode. npm packages can run preinstall, install, postinstall, or prepare hooks, and those scripts receive useful environment information. A warning is not much of a boundary if the agent proceeds anyway.

For example, a postinstall hook could inspect exposed process environment data while downloading or compiling a native component. That is a plausible threat model, not a claim about a particular attack. A sensible default would combine a practical sandbox, lockfile and integrity checks, and human approval before enabling hooks or broader network access. Lockfiles improve reproducibility; they do not establish that code is benign.

The cost is real: native modules and Python builds may need compilation, so first-run setup could require a second pass or explicit approval. Would developers accept slower onboarding for a safer default? I’m interested in counterexamples or better designs.

I’d make the isolation boundary the default, but avoid pretending one container solves everything. No network plus a read-only project view is a better baseline; then grant narrowly scoped access for the specific build step. Approval should show the command, requested paths, and destination domains—not just “this may be risky.”

For a brand-new checkout, this sounds like a support-ticket generator. People will approve the prompt reflexively, then blame the agent when setup takes three attempts. I’d reserve the strict mode for untrusted repositories or sensitive environments and keep a fast path for known projects.

The distinction between “can execute” and “is malicious” matters here. Lifecycle scripts are legitimate build machinery too, and the brief evidence supports a capability risk more directly than an observed exfiltration incident. I favor approval gates, but the UI should explain what was blocked and why, rather than treating every hook as hostile.

A useful compromise might be two modes: reproducible offline setup from an existing lockfile, and a clearly labeled bootstrap mode that asks for network access once. If the agent can explain which package requires the exception, I’d tolerate the slower first run. Silent ambient access is the part I don’t want.