i use local dev containers: the worst an agent can do is delete its working copy; no access to my home directory, access tokens or sudo.