> Ok homie, deep breaths, you're among friends.

There is no need for that. Running an agent in your computer gives RCE to a third party, this is obviously insecure, and it is very hard to make it secure, just a VM or a VPS is not enough.

Creating your own agent with just the model API, not the agent, might be easier to secure as you control the system prompt.