What Windows AI agents are and why permissions matter
Windows AI agents are background helpers that can read your screen or files, run apps, and perform tasks for you, so managing which model they use and what they can touch is the difference between a useful assistant and a silent security risk.
If you like the idea of Copilot doing chores but dislike the idea of it roaming through your personal folders, this is for you. Microsoft’s new Intelligent Terminal is an experimental fork of Windows Terminal that adds an AI pane without touching your existing terminal, so you opt in instead of having AI pushed into your shell. At the same time, Windows 11’s Agent Workspace and Copilot Actions can drive the desktop, open apps, and move files, which is powerful but sensitive.
The real prerequisite is mindset: assume AI is another untrusted user on your PC. Your goal is to pick a model you control, then scope its access to the smallest set of files and actions it needs for one job at a time, instead of granting broad standing permissions.
Why local LLMs in Intelligent Terminal are safer Copilot alternatives
Intelligent Terminal is built on the Agent Client Protocol (ACP), an open standard that lets any compatible AI agent plug into the terminal as a subprocess over stdio. In practice, it does not care what model you use or who built it; it only cares that something on the other end of the ACP pipe can receive shell context and send back responses.
By default, the terminal offers GitHub Copilot and can install it for you through WinGet, but the agent dropdown also lists Claude Code, OpenAI Codex, Google Gemini, and Pi, an open-source coding agent that works with cloud providers and local models through llama.cpp or Ollama. That means you have real Copilot alternatives on Windows without giving up the integration. If you want Copilot, use Copilot; if you want a local model on your own GPU with an open-source agent harness, that is equally possible.
This matters for Windows AI agents security because running a local LLM in the terminal keeps prompts and code on your machine, instead of sending your shell history and error logs to a remote service. Combined with scoped file access, you can have helpful AI in the tools you live in all day without opening your entire desktop to a persistent cloud agent.
Step‑by‑step: Set up a local LLM in Intelligent Terminal
Getting a local LLM talking to Windows Terminal through Intelligent Terminal is faster than it looks. One reviewer had a local model working in about five minutes using Pi and Qwen 3.6 27B over llama.cpp. You are wiring together three pieces: the terminal, an ACP-capable agent like Pi, and your local model backend.
- Install Intelligent Terminal alongside your existing Windows Terminal so you can try AI features without changing your main shell.
- Set up your local model backend (for example, llama.cpp or Ollama) and confirm it can run a model such as Qwen 3.6 on your machine or home server.
- Install the Pi ACP extension (pi-acp), which is an open-source coding agent that can talk to local models through your chosen backend.
- Open Intelligent Terminal’s settings and change the default AI agent from GitHub Copilot to the pi-acp agent entry in the agent dropdown.
- Edit Pi’s models.json configuration to set your default model to the local backend endpoint, for example Qwen 3.6 27B running through llama.cpp on your home server.
- Restart Intelligent Terminal and trigger the AI pane on a failing command; confirm that responses come from your local model rather than any cloud provider.
Once that is done, you have a Microsoft terminal talking to a community-built ACP bridge, driving an open-source coding agent, backed by a model from Alibaba, working alongside your terminal. The main mistake people make here is assuming Intelligent Terminal is locked to Copilot and stopping at the default, instead of flipping the agent to a local LLM that respects their privacy preferences.
Tighten Windows AI agents security with scoped file access
On the desktop side, Agent Workspace creates contained desktop sessions under its own standard Windows account, separate from your logged-in user, without admin access and under existing logging and access control lists. That is a solid base, but the way Copilot Actions handles files is where risk appears. When Copilot Actions needs your files, it requests read and write access to six known folders: Documents, Downloads, Desktop, Music, Pictures, and Videos.
Those six locations are where most people keep their entire digital life, from tax PDFs and SSH configs to screenshots and work documents. Granting permanent access there is like giving a stranger the keys to your study. The writer who tested Copilot Actions enabled it, read what it wanted access to, tried it for an afternoon, and then turned it off again because they “couldn’t live with giving that level of control away.”
The safer pattern is scoped file access permissions: refuse long-standing access to your file system, and instead give agents temporary access only to the folders or shares needed for the task at hand, then revoke that access when the task is done. Scope access to the task, isolate the runtime, keep private data on-device, and log what happens. Until Windows adds per-app scoping and trustworthy logs for Copilot Actions, turning off broad permissions while still using local agents in Intelligent Terminal is a reasonable compromise.
Common mistakes and what “good” looks like
There are two big traps people fall into with Windows AI agents. The first is thinking deep desktop integration is impossible without cloud Copilot, so they accept wide file access by default. In reality, Intelligent Terminal already proves you can keep AI tightly tied to your shell while controlling which model runs behind it and keeping data local. The second is trading away long-term privacy for short-term convenience by granting standing access to those six sensitive folders, then forgetting the agent still has that reach weeks later.
A better pattern looks like this: you run Copilot alternatives in Windows such as Pi with a local model through ACP; you turn on Copilot Actions only when you have a specific task, like bulk file moves; you scope what it can see to a working directory, not your whole profile; and you disable broad permissions after the job completes. You have not given up on agentic file work, but you have refused long-standing access to your file system and kept the sensitive parts of your digital life on-device.
When you are done, you end up with a setup where agents can open apps, click, type, scroll, move files between folders, and extract tables out of PDFs while you keep working on other tasks, but your most personal folders are not permanently exposed. That is a fair trade: useful AI, local LLM Windows Terminal workflows, and scoped permissions you can live with over the long term.
