Run PowerShell commands from ChatGPT safely

Guide · about 6 minutes to read · updated October 20, 2026

The most useful thing ChatGPT can do on a PC is often not editing a file but running a command: checking disk space, reading the event log, running tests, restarting a dev server. It is also the most powerful thing, so it deserves a clear explanation. Here is how terminal access works with Bridgerator, what stops a bad command, and when you should simply turn the terminal off.

How it works

When you ask for something that needs a shell, ChatGPT calls the start_process tool with a command. The bridge on your PC starts it in PowerShell (or cmd), waits for output and returns it. For long-running programs — a build, a test watcher, an SSH session — ChatGPT can keep the process running, send it more input with interact_with_process and read new output later. It then decides the next step from what it sees, the same way you would.

You: Why is drive C: almost full?
start_process  Get-PSDrive C
start_process  Get-ChildItem C:\Users\anna -Directory | sizes, top 20
ChatGPT: Downloads takes 61 GB, old installers 24 GB.
         Want me to list what is safe to remove?

What protects you

• Your user, not an administrator. The bridge runs as your Windows user from a scheduled task at sign-in — never as SYSTEM and without admin rights. A command can't do anything you couldn't do yourself in a normal PowerShell window.
• Blocked commands. A built-in list of dangerous system commands is refused: format, diskpart, reg, net, sc, runas, netsh, takeown and others. You can replace the list with your own under blockedCommands.
• Confirmation. Tools that can change things are marked for ChatGPT as needing your confirmation; read-only tools are marked as safe.
• Instant off switch. bridgerator.cmd uninstall stops the bridge and access ends at once.
• Encrypted in transit, not stored. Commands and their output travel over TLS and are not saved on the Bridgerator server.

What the terminal is not

It is not a folder sandbox. A PowerShell command can read anything your Windows account can read, including folders you excluded for the file tools. Bridgerator refuses commands that literally name an excluded folder, but that is a courtesy, not a security boundary — a command can reach the same place in other ways.

So the rule of thumb is simple: if your folder limits must be strict, turn the terminal off.

How to turn the terminal off

1. Open %APPDATA%\Bridgerator\config.json.
2. Set "disabledTools": ["start_process", "interact_with_process"].
3. Run bridgerator.cmd setup to restart the bridge. ChatGPT will no longer see those tools; file tools keep working.

How to block specific commands

Add a blockedCommands list to the same file. When this key is present, it replaces the built-in list, so include the defaults you still want:

"blockedCommands": ["format", "diskpart", "reg", "net", "sc", "runas", "netsh", "takeown", "git push"]

Habits that keep commands safe

• Ask "show me the command first" for anything that deletes, installs or changes system settings.
• Prefer read-only questions first: "what is using port 3000?", "show the last 50 lines of this log".
• Keep backups and use version control for code. AI assistants make mistakes.
• Never paste secrets into the chat, and don't ask ChatGPT to print files with passwords or keys.

Good uses for the terminal

More are in the prompt library. Security details are on the security page; if you haven't connected yet, start with connecting ChatGPT to your PC.