Agents That Install Packages You Did Not Ask For

AI coding agents are designed to reduce the friction of software development by automating repetitive tasks, but they often exhibit a specific failure mode: agents that install packages you did not ask for without explicit confirmation. This behavior usually stems from an agent attempting to solve a compilation error or a missing utility by reaching for the nearest package manager. While this autonomy can be helpful in a sandbox, it introduces significant risks regarding project bloat, supply chain security, and environment stability in professional workflows.

The Logic Behind Uninvited Dependencies

Most autonomous agents operate on a loop of observation, thought, and action. When an agent encounters a "module not found" error during a test run or a build process, its internal logic often dictates that it must resolve the missing requirement to fulfill its primary objective. If the agent has access to a terminal or a shell, it will instinctively run commands like npm install, pip install, or cargo add.

This becomes problematic because the agent does not always understand the nuances of your project architecture. It might install a heavy utility library when a simple native function would suffice. It might also choose a package with a similar name to what it needs but which contains malicious code, a risk commonly known as typosquatting. The agent is optimized for task completion, not necessarily for the long term health of your dependency graph.

Risks of Autonomous Installation

Allowing an agent to modify your package.json or requirements.txt without oversight can lead to several technical issues.

• Dependency Bloat: Agents frequently pull in massive libraries to solve tiny problems. This increases build times and the final bundle size of your application.
• Version Conflicts: An agent might install a version of a library that is incompatible with other parts of your stack, breaking the build in ways that are hard to debug.
• Security Vulnerabilities: By adding new entries to your dependency tree, the agent increases the attack surface of your application. Every new package is a potential vector for a supply chain attack.
• License Compliance: Agents do not typically check the license of the packages they install. This could accidentally introduce GPL licensed code into a proprietary project.

Strategies for Managing Agent Permissions

Developers must decide where to draw the line between autonomy and safety. Different tools handle this in various ways, usually falling into one of three categories:

For most professional environments, the Human in the Loop model is the most sustainable. It allows the developer to catch agents that install packages you did not ask for before they touch the disk.

How Deska Handles Agent Autonomy

Deska provides a unique environment for running AI coding agents such as Claude Code, Codex CLI, and OpenCode. Because these agents run in side by side panels on an infinite canvas, you have a direct view of every command they attempt to execute.

The Ask Deska assistant can drive the workspace by opening terminals or checking existing sessions, but the core philosophy remains local-first. Your code and files stay on your machine, and you retain control over the terminal environment. When an agent inside a Deska panel wants to run a command, you are the one supervising the terminal output.

Using the infinite canvas, you can place your code editor next to the agent terminal. If you see the agent trying to install a package, you can intervene immediately. This visual layout makes it easier to spot when an agent is straying from the intended path.

Implementing Policy via Environment Design

To prevent agents from cluttering your project, you can use specific environment configurations. One effective method is to use a containerized or virtualized environment where the agent has limited permissions.

1. Use Read Only Filesystems: You can mount your source code as read only and only allow writes to specific directories. This prevents the agent from modifying configuration files like go.mod or pom.xml.
2. Environment Variables: Some agents respect environment variables that toggle "safe mode" or "auto approve" behaviors. Always check the agent documentation for these flags.
3. Separate Panels: In Deska, you can run an agent in one panel and a restricted shell in another. You can then copy the code changes from the agent and run the installations yourself in a controlled terminal.

The Importance of Local Context

Agents often install uninvited packages because they lack context about what is already available in your environment. If an agent cannot "see" that a utility library is already present in your project, it will try to install it again.

Deska helps bridge this gap by keeping all agent threads and data and storage local. By running agents directly on your machine instead of a remote cloud environment, the agent has better access to the local context of your filesystem, provided you give it permission to index those files. This reduces the likelihood of the agent making redundant or unnecessary installation calls.

Frequently Asked Questions

Why does my AI agent keep installing npm packages?

Agents often do this to resolve errors they encounter during code execution. They are programmed to fix broken builds, and the most common fix for a missing module is to install it via the package manager.

Is it safe to let an AI agent run terminal commands?

It is generally unsafe to give an agent unrestricted terminal access on a production machine. It is better to use a tool that allows you to review commands or run the agent in a sandboxed workspace.

How can I stop an agent from changing my dependencies?

You can use a restricted shell or configure the agent settings to require human approval for all write operations. Monitoring the agent in a dedicated UI like Deska also helps you catch these actions in real time.

Get Started with Controlled AI Coding

Managing agents that install packages you did not ask for is a matter of choosing the right workspace. By using a tool that prioritizes visibility and local control, you can enjoy the benefits of AI automation without losing the integrity of your codebase.

Deska offers a free desktop app for Mac, Windows, and Linux that lets you run multiple agents side by side. You can use your own API keys or choose a subscription for managed inference. The environment is designed to keep you in the loop, ensuring that every package added to your project is a conscious choice.

Download Deska and take control of your AI development workflow today.