Coding agents run shell commands with your user's privileges, whether it's Claude Code, Codex, or an open-source harness like OpenCode running against your own models. Their own guardrails have come a long way, but a prompt injection hidden in an open-source package can still turn the agent against your machine. Agents belong in a sandbox, especially when you run a swarm of them.

This article shows how I sandbox mine in a dev container: the agent works on the project inside the container, the host keeps the git credentials, and notifications get out through a single whitelisted command. One trade-off up front: containers are slower on macOS and Windows, where they run inside a virtual machine with limited access to the bare metal.