What can an AI agent touch in Rushilo, and what can it not?

When you connect an AI agent to a video editor, the fair question is what that agent can reach. Editors are already asking it: after DaVinci Resolve 21.1 added support for AI assistants in September, a thread in r/editors drew the line this way.

We make Rushilo, so we read our own desktop code to answer for it. This page lists what we found in Rushilo 1.2.0, including limits we would rather you hear from us. We read the source; we did not run the app or capture its network traffic, and where that matters we say so. For the general method of questioning any editor, see local vs cloud AI video editing. The Resolve announcement is here only as context for why the question is current; we make no claims about its security.

The short answer

Three limits matter most, and each has its own section below. The agent can import a media file from any path on your disk, not only from folders you chose. If you connect Claude Code or Codex yourself, it keeps its own file and shell tools under your own settings, which Rushilo cannot limit. And what the agent reads goes to your model provider.

Can Claude access my files through Rushilo?

The agent talks to a local server that Rushilo starts, named rushilo. It reaches it over a local socket on your computer (a named pipe with a new name each launch on Windows), not a network port. The tools fall into groups:

Import is narrower than it sounds. It accepts only what Rushilo can read as media: a file with a video or audio track, or an image file (png, jpg, jpeg, webp, gif), plus a .cube color table. Anything else is refused. The folder tool is read only: it lists media inside the reference folders you added in Settings and never writes there.

When the agent asks Rushilo to describe the project, it gets file names, kinds and durations. A full path appears only for a file that is missing, so it can be relinked.

What can the agent change, and what is blocked?

The blocked actions are not blocked because agents are untrusted by nature. Our own code explains it: an agent can be steered by text in the media it reads, so the actions that throw work away, rewrite your brand or cost you money are kept in your hands.

Can the agent read my API keys?

Does Rushilo send my video anywhere?

Cloud transcription sends the audio of the clip, cut into 16 kHz WAV pieces, to the provider whose key you chose. On-device captions use Whisper on your computer after a one-time model download; see how local subtitles work. The agent itself needs its provider to work, so offline you can still edit and export, but you cannot talk to Claude or Codex.

One more place runs code: when an agent writes an HTML code clip, Rushilo renders it in a hidden window with no Node, network requests refused, no permissions, no downloads and no new windows, able to load only its own folder.

What does my AI provider still receive?

The agent can request up to 8 preview frames per call, up to 1280 pixels wide. What Rushilo does not send is the source video file itself. The exception is cloud transcription, covered above, and any pictures you attach yourself in the built-in panel.

Retention is the provider’s decision, not Rushilo’s. For Anthropic, as of October 14, 2026:

Anthropic’s data usage page also says that Claude Code sends all user prompts and model outputs over the network, encrypted in transit with TLS 1.2 or newer, and that Claude Code keeps local session transcripts in plain text under ~/.claude/projects/ for 30 days by default. Anthropic’s pricing page lists model training as opt-out on Free, Pro and Max, and none by default on Team and Enterprise. We did not read OpenAI’s retention terms for Codex, so we make no claim about them; read them before you connect it.

Does Rushilo check my licence or track me?

Activation opens rushilo.com in your browser with a random device id, and the licence comes back through a one-time listener on your own computer that accepts only a request carrying its own random state, then closes. Agents never see or set a licence. For updates, the app checks the public releases repository on GitHub shortly after launch and every four hours and downloads a new version in the background; you can turn that off in the app, after which it checks only when you ask. GitHub sees what any web request shows, such as your IP address. We have not read the update library’s exact request, so we say no more than that.

What are the limits of these protections?

No folder sandbox on import. The paths an agent passes to import, relink and folder search are checked only to be absolute. They are not limited to the reference folders you added. An agent can import any media file it can read on your disk. The reference folders tool is a convenience listing, not a fence. If you want a fence, the place for it today is your agent’s own permission settings.

Overwrite is the agent’s flag. As described above, the agent chooses whether to pass overwrite when it saves an export, captions file or still. For exports and stills, Rushilo tells it to do that only when you asked. That is an instruction, not a lock.

Claude Code keeps its own tools. When you run claude mcp add rushilo ..., Claude Code can still read files and run commands through its own tools. Rushilo’s limits apply to the rushilo tools only. Whether Claude Code can read your Documents folder is decided by Claude Code’s permission model, which Anthropic describes this way on its security page: “A session’s permission mode sets which actions Claude can take without asking you first.” The same page says Anthropic does not security-audit or manage any MCP server. Codex has its own sandbox settings.

In Rushilo’s built-in agent panel, Rushilo starts Claude Code with only its own tools pre-approved and Codex in a read-only sandbox. That changes what runs without asking. It is not a ban on Claude Code’s other tools, which still follow your own Claude Code settings, and we have not tested what the panel does when Claude Code asks for one.

Local means the same user account. The connection is protected by a random 128-bit token made fresh at every launch, compared in constant time. Unauthenticated connections are dropped after 10 seconds, and at most 16 are open at once. The token sits in a small discovery file in Rushilo’s data folder, which on macOS is ~/Library/Application Support/Rushilo, and we set it to owner-only mode. Any program running as your user can read that file. “Local” here means local to your account, not isolated from your other software.

Agents can be steered by what they read. A caption, a transcript or a file name can contain text meant for the agent. This is why the blocked list above exists, and why we ask you to read the confirmation dialogs rather than click through them.

How can you check this yourself?

• Go offline. Editing, local captions (after the model download) and export should keep working. The agent will not, because it needs its provider.
• Check the discovery file. On a Mac, ls -l ~/Library/Application\ Support/Rushilo/agent.json should show -rw-------, which means only your user can read it.
• Read the settings. Rushilo lets you turn off automatic update checks and turn asking back on for each kind of paid job.

To test any editor, not only ours, use the MCP editor evaluation checklist.

How is this different from giving an agent your whole computer?

If your worry is the one in the quote at the top, the practical advice is the same for any editor. Use your agent’s permission settings to decide what it may read and run, keep confirmation prompts on, and treat any frame or transcript the agent reads as something your provider will receive. To connect an agent, follow the setup guide, and see the privacy policy and terms for the legal text and the release notes for what changed in each version.

Patel, O. (2026, October 14). What can an AI agent touch in Rushilo, and what can it not?. Rushilo. https://rushilo.com/blog/ai-agent-permissions

About the author

Om Patel

Founder, Rushilo

Om Patel is the founder of Rushilo, a desktop video editor driven by the user's own AI, and of BigIdeasDB, a research platform that reads real complaints and reviews to help founders validate products. He writes Rushilo's research articles with the same method: primary sources, dated numbers and the words real users write.

• X (Twitter)
• BigIdeasDB