Desktop AI assistants can read files, run commands and edit documents on your own computer. That is what makes them useful for real work, and it is also why they deserve the same care you give any software with access to your files. This checklist is how we think about it at Productive IT, using our free PIT Agent as the worked example.

1. Verify what you install

Download only from the publisher's own page, and compare the file's SHA256 checksum with the one the publisher lists. On macOS and Linux, run shasum -a 256 on the file; on Windows, run Get-FileHash in PowerShell. If the values differ, delete the file.

PIT Agent publishes a SHA256 for every installer and a SHA256SUMS.txt file. Its builds are not code-signed yet, which is exactly why the checksum step matters, and the download page says so plainly.

Download PIT Agent and checksums →

2. Give it only the folders it needs

Point the assistant at a project folder, not your whole home directory. Keep confidential documents, password exports and personal files outside that folder. If the assistant offers per-project workspaces, use them.

3. Keep a human on risky actions

  • Require approval before commands that delete, move or overwrite files.
  • Require approval before anything that sends data out: emails, uploads, git pushes or API calls.
  • Read the command, not only the summary, before you approve it.
  • Prefer assistants that show live activity, so you can see what is happening as it happens.

4. Keep backups and a record

Before a large change, make sure the folder is backed up or under version control, so any mistake can be undone. Keep the assistant's activity log for anything that touches client or finance files.

5. Keep secrets out of prompts

Do not paste passwords, API keys or customer personal data into a prompt. Store credentials in a password manager or environment file that the assistant does not need to read.

Frequently asked questions

What is PIT Agent?

PIT Agent is Productive IT's free local AI work assistant for Windows, macOS and Linux. It works in your project folders, shows live activity and asks before risky commands.

How do I verify a download with SHA256?

Compute the file's hash with shasum -a 256 on macOS or Linux, or Get-FileHash in Windows PowerShell, and compare it with the value on the publisher's download page.

Is PIT Agent free?

Yes. It is free to download and use. Donations help fund code signing and development.

Related reading