Don't Let the Model See Your Drive: Path and Privacy Rules for an AI-Driven Desktop App

Key takeaways

• When an AI assistant uses KwaFlux, it tells KwaFlux which file to work on. What comes back is kept small: a task ID, a status, and the output file's name, not paths or folder listings.
• Network paths are refused before KwaFlux opens anything, because on Windows just opening one can send your sign-in credentials to another machine.
• Outputs are written next to the source file, and if a file with that name already exists, the new file gets a numbered name instead of overwriting it.
• KwaFlux's usage telemetry for AI calls records the method, the result, the duration, and the task ID, without any parameters.

An AI assistant that drives a desktop app sits between two things you care about: your files and a cloud model provider. Anything the app sends back to the assistant becomes part of a conversation that goes to that provider. So KwaFlux is careful about three things: which paths it accepts, where it writes, and what it reports.

In this guide, you'll learn what goes in and comes out of a KwaFlux tool call, why network paths are dangerous for AI agents, why the assistant can't choose the output folder, and what KwaFlux records about AI calls.

Contents

1. What does an AI assistant learn about your files?
2. What goes in, what comes out
3. Why network paths are refused first
4. Absolute, local, and checked twice
5. Where results are written
6. Results built from an allowlist
7. What KwaFlux records about AI calls
8. What still reaches your AI provider
9. FAQ

What does an AI assistant learn about your files?

An AI assistant learns whatever you type or paste into the chat, whatever its own tools can read on your computer, and whatever the apps it calls send back to it.

KwaFlux can only control the last part. Its rule is to send back what the assistant needs to report the result and continue, and nothing more.

What goes in, what comes out

Here is a diagnosis request, the first step of a video file repair:

The input path is the one thing the assistant knows for certain, because it supplied it. KwaFlux doesn't add to that: it doesn't return full paths, list folders, or report where your profile or other files are.

Why network paths are refused first

On Windows, a path that starts with two backslashes, such as \\server\share\video.mp4, is a UNC path to a network share. When a program opens one, Windows may automatically try to sign in to that server with your account.

That's what made the 2023 Outlook vulnerability serious. In its advisory, Microsoft's Security Response Center explained that a message carrying "a UNC path to an SMB (TCP 445) share" on an attacker's server caused Outlook to connect, and that the connection "sends the user's NTLM negotiation message," which the attacker "can then relay for authentication against other systems." No click was needed.

An AI assistant can be handed such a path by text it reads: a file name in a shared document, a line in a web page, a pasted message. If KwaFlux opened it, even only to read the video's dimensions, Windows could start that sign-in. So KwaFlux refuses network paths before any file access, not after it fails to read the file.

Absolute, local, and checked twice

The path rules are short:

• Absolute only. A relative path like ..\clip.mp4 depends on a "current directory," which for a background process may not be where you think. Microsoft's path documentation explains that a path without a drive and backslash, or with .., is resolved against the current directory. KwaFlux asks for the full path instead of guessing.
• Local only. UNC paths and other network locations are refused.
• Checked in both processes. The KwaFlux app checks every path. The MCP process, which runs inside your assistant's environment, checks it the same way before it reads anything itself, such as a video's dimensions for an output-size choice. When it reads media information, it uses only the local file protocol.

The second check matters because an earlier version of one enhancement tool read the input file's information in the MCP process before the request reached the app's checks. That's fixed: the MCP side now applies the same rules first.

Where results are written

The assistant chooses what to process, not where the result goes:

• Next to the source. A converted, repaired, or enhanced file is written in the same folder as the original. The assistant can't point output at another folder, such as a startup folder or a synced share.
• No silent overwrites. If clip.mp4 already exists there, the new file becomes clip(1).mp4, the same rule the app uses when you export.
• Resends are recognized. If the assistant sends the same request twice, for example after a timeout, it gets the original task back instead of a second copy of the job.

Link downloads are different: they go to an existing folder, and with Ask every time the approval popup shows which one.

Results built from an allowlist

Every result KwaFlux sends to an assistant is built from a fixed list of fields, rather than by passing along whatever the engine produced. This keeps out things that weren't meant for a model: internal paths, debug output, and other users' or other assistants' details.

A few rules shape the task list in particular:

• Tasks are sorted newest first, so when a list is cut short the assistant sees the recent ones.
• Only tasks that succeeded say they have an output, and they give the output file's name. A queued or failed task doesn't claim to have produced anything.
• The list can be filtered to the tasks this assistant submitted.

Text from the web, such as a video's title, gets extra cleaning before it reaches the model. That's covered in prompt injection in web video titles.

What KwaFlux records about AI calls

The activity list is there so you can see what your assistants have been doing. It deliberately leaves parameters out, so it doesn't become a record of file names on screen. For KwaFlux's overall data practices, see the Privacy Policy.

What still reaches your AI provider

Being honest about this boundary matters. KwaFlux processes media on your computer: AI processing runs locally on your GPU — media files are not uploaded for processing. But your chat with the assistant goes to that assistant's model provider, as usual. If you type D:\Clients\Acme\contract-video.mp4, the provider sees that path because you typed it.

If file names themselves are sensitive, rename the file or move it to a neutral folder before you ask. KwaFlux won't add to what the conversation already contains, but it can't remove what you put there.

Sidenote: The MCP specification has a feature called Roots, where the host tells a server which folders the user considers in scope. We looked at limiting paths to roots, but hosts usually declare a code workspace, and videos rarely live there. The 2026-07-28 revision of the specification also deprecates Roots. If we use it, it'll be an optional extra limit.

Final thoughts

The model gets the path you gave it and a short, structured answer back: no folder listings, no full output paths, no network paths opened on its behalf, and no parameters in the logs. Results land next to the original and don't replace an existing file. The rest is up to what you type into the chat.

Keep your files on your computer

KwaFlux's local MCP server lets Codex, Claude, Cursor, and other MCP apps process files where they are, and write results next to them. It runs on Windows 10 (64-bit, version 1809 or later), Windows 11, and macOS 12 or newer on Apple Silicon. Importing files and exploring the app need no account. Signing in with an active paid plan is required only to export, convert, repair a file, or download a file from a link.

Download KwaFlux · See plans