Yes this seems like a perfectly sensible approach? You say that as if it's a bad thing

But let's be honest, if I hooked up a PRNG to a terminal and somehow against all odds, it ended up hacking something, who is to blame?

I don't see how that assessment should change if the PRNG gets even better and is more likely to to be hacking stuff.

You can replace PRNG with Markov Chain, or whatever, if it helps.

What may also help is the age old saying: If everybody else jumps off a bridge, doesn't mean you should too.

This seems like one of those things that prior to AI companies convincing us otherwise would have been obvious.

Least privilege and say only opening ports or installing applications an application needs to operate are extremely standard security practices.

We talk about a firewall blocking exultation of data, why not blocking exfiltration of your agent ?

I agree, I like running claude code in my container with auto mode enabled and web access (obv to api.anthropic, even npm for pulling), I will admit. And I can't imagine going back to manually approving each prompt.

I think it boils down to a reasonable expectation of model and harness behaviour. When I use claude code I expect certain guardrails for the model. For these cyber attacks, these models are specifically run without guardrails, on a cyber task, on a lax harness!

I don't think we should force end users to have to worry about agent security, I like long-running agents, but we need to direct regulations towards these actors that know better, have access to base models, and have much more compute than the average person.

Human approval does not prevent autonomous agents from running without supervision.

The fact that you believe that to be the case is exactly what's wrong with "agentic computing as it's currently envisioned".