3 ms·

So your shared .venv is the vector for the agent to escape the sandbox.

• lemontheme 7mo ago
  Haha true. I’d considered that. But then, so is any code the agent writes, which will ultimately run outside the sandbox. So it’s certainly not perfect. An isolated VM or a VPS provides the best guarantees. For me though it’s good enough. I’ve put my risk profile at: ‘don’t fuck up my system directly and don’t exfiltrate secrets directly’