> Giving an agent a shell environment with the ability to access the internet is fraught with risk

A good middle ground is to give it a shell environment with no access to the internet, but with standard tooling like python, perl, jq, and sed plus a custom CLI which can talk to a server which does have access to the internet.

This way it can still be flexible about preprocessing input and postprocessing output re: that CLI, and any secrets stay server-side and out of its reach.

Let it change the CLI and the server, but deploy the updated server by hand, that way you're in a position to review and if necessary prevent the agent from adding any capabilities that it shouldn't have.