LobsterAI

Least-privilege permissions

• Run LobsterAI under a limited user account (not admin/root) so a compromised agent can't access system-wide files or install software.
• Restrict folder access: Only give LobsterAI permission to specific work folders, not your entire Documents or Downloads. Treat it like you'd treat a contractor—limit what they can touch.
• Disable unnecessary integrations: Only enable messaging platforms (WeChat, Telegram, etc.) you actually use; each connection is another door an attacker could use.
• Store sensitive credentials separately: Don't leave passwords, API keys, or tokens lying in shared folders where the agent might accidentally grab them; use a password manager with restricted access.

Network isolation

• Run on a dedicated or air-gapped device if handling highly sensitive data (financial, health, legal records); avoid running LobsterAI on machines that connect to critical business networks.
• Use a VPN or firewall rules to restrict what LobsterAI can contact—block outbound connections to unknown servers and only allow messaging platform APIs you've verified.
• Keep messaging accounts separate: Use dedicated phone accounts or app instances for LobsterAI commands, not your primary personal accounts; if one gets hacked, it doesn't compromise everything.
• Disable cloud sync on local folders LobsterAI accesses (OneDrive, Google Drive, iCloud) to prevent sensitive files from being automatically uploaded if the agent is compromised.

Monitoring

• Log all agent actions: Enable detailed logging (if available in LobsterAI settings) so you can review what commands ran, what files were accessed, and what was sent over the network.
• Regularly audit messaging accounts: Check login history and active sessions in WeChat, Telegram, etc. to spot unauthorized access; consider enabling two-factor authentication.
• Monitor file system activity: Use built-in OS tools (Windows Event Viewer, Mac Activity Monitor) or free tools to watch for unexpected file reads/writes or data transfers when the agent runs.
• Set alerts for unusual behavior: Track network traffic spikes, large file transfers, or access to folders outside your normal workflow—these can signal data theft in progress.

Red flags to watch for

• Unexpected messaging platform logins on devices you don't recognize, or commands arriving at odd hours when you didn't issue them—sign of a compromised messaging account.
• Large files being uploaded or transferred to unknown cloud services or external IP addresses without your command.
• Agent requests to access sensitive folders (tax returns, health records, credentials) that have nothing to do with your actual work task—classic sign of prompt injection or manipulation.
• Slow performance, battery drain, or constant disk activity when LobsterAI isn't running a visible task; could indicate background data exfiltration or crypto-mining.