I run my agents in a VM. They don't even have access to their own LLM API keys.