Well, yes, exactly! You shouldn’t trust it.

If this was any other computer program that could execute arbitrary system commands unreliably, standard procedure would be to sandbox the living snot out of it.

It’s baffling to me that “AI” is somehow an excuse to ignore this. Hence that’s exactly what I mean: I’d want rock solid guarantees of containerization, and granular scoping.