The focus since v1.3.0 has been entirely on host security: 1. Native Sandboxing: Added seatbelt profiles for macOS and constraints for Linux execution. 2. Container Hardening: The Docker image now enforces non-root execution and read-only filesystems. 3. Model: Shifted to a strict IAM + Sandbox + Container architecture.
The goal is to enable "Agentic" workflows with AWS without exposing the local host to arbitrary code execution risks.