This goes to the biggest problem imho - that we've gone this far down the track of these agents being rolled out without proper sandboxing.

The agent should not be running on the same workstation. It should have a hard isolation barrier between it and the host machine. We shouldn't be starting from a fail-unsafe state and then trying to patch in security and isolation for these people. It should be deployed fail-safe and when they hit actual friction we can solve that.

Anthropic started out doing the right thing with Cowork (running in a VM). But it seems like they've ever since been walking that back and trying to get users to rely on automatic protections. I think it's just the wrong direction.