Very intense post from @halle on what it takes to really sandbox a local agent.

The goal is (close to) zero trust: the agent can read and write in one working directory and nothing else. Getting there takes a hardened local model server, a sandbox profile with nearly everything switched off, a DNS workaround, and then 42 tests to check the boundaries are where you believe them to be.

https://theoffcuts.org/#part-2-of-3-the-sandboxed-local-agent