The model just generates some tokens that "politely" instruct the harness to run a shell command and then feed the results back in. The harness can do anything

The model just generates some tokens that "politely" instruct the harness to run a shell command and then feed the results back in. The harness can do anything it wants with that request. It can refuse, wait for operator approval, wait for multi-party approval, it can ask another LLM whether it thinks that command is safe to run, or it can just run it. > Or make it so the models are only accessible through sanctioned sandboxes, perhaps built into the computer. That's going to be as futile as trying to outlaw `curl | bash` - by mandating that all computers must refuse to pipe curl into bash, and that HTTP servers must refuse to serve requests that are going to be piped into bash.