> people let AI agents have full unrestricted access to their system

Not everyone is like this. I've never ran Claude Code unsandboxed. I took the time to firejail it since day one. One of the first things I did was ask it to write a virtual machine orchestration tool so I could virtualize entire projects and their associated AI sessions. Mitigates supply chain attacks too.

I managed to rig up a firewall and it withstood a Fable code review. I'm now writing a custom network stack for it in Rust so I can firewall every single network connection.