I see. We are picturing a malicious LLM here that Im basically trusting. But zero trust is a thing.

Those can still be handled by system tooling, setattr in the .git dir that prevents executable permission, container binded to a network on a VLAN that is in DMZ.

I could even whip out selinux policies that would let me know if the LLM tried to drop an executable where it's not allowed.