sandboxing

Tokens cost under a dollar per run; reviewer time costs thirty times that. Choose the task classes, the permissions and the gates that decide what a human ever sees.

A textbook confused-deputy attack on a powerful agent. The interviewer wants the mechanism, the full set of controls (sandbox, network, secrets, approvals), and a response plan for the disclosure.

Models sometimes invent package names, and attackers register them. Keep prototyping, but allow-list common libraries, check that new packages exist and are established, and install in a sandbox with no secrets.