Why sandboxing is non-negotiable
An agent with a raw shell is a footgun. The sandbox narrows what the agent can touch: an allowlisted set of commands, a workspace it cannot leave, and deletes that go to the trash instead of vanishing.
What the sandbox enforces
- Argv-based commands — never a raw shell string to inject into.
- Workspace boundaries — files live inside a known folder.
- Deletes to trash — recoverable by default.
- SSRF-safe networking — no hitting internal endpoints.
- Always-blocked patterns — sudo, rm -rf /, pipe-to-shell downloads.
Secure mode
For the most sensitive work there is a locked-down mode: read-only shell, files only inside the workspace, no network, browser, web, apps, or notify tools, and no skills. It cannot be loosened by any prompt.
The local policy is the final authority
Even with a permissive profile in the dashboard, the policy file on your machine always wins. That way a misconfigured cloud setting cannot override what the device owner decided.
A realistic example
i
Ask the agent to "clean up old files". It lists candidates, moves them to the trash, and asks before anything permanent. Nothing is deleted without a yes.