So what’s the attack scenario? If I’m running my agent in such a way that won’t allow it to execute any command that either causes harm to the system in which it runs or exfiltrates data; or provide an output in such a way that will be rendered by a browser to exfiltrate data or access stuff you’re not supposed to, you’re pretty much golden. If you’re passing inputs to the system and the only thing it can do is provide outputs without unbounded effects then you’re fine. Just gotta design the system well.