Not argumentative at all. I've spent the last 6 months working on these problems and built the original Agentic Identity solution at my large company this January. Getting Agents secure and scalable means a lot to me and I have some counter intuitive thoughts on it. Everyone has been working on this stuff though and there's tons of different opinions on the matter so I think all open discussion is good and healthy.

I think it's what are you trying to achieve, the risk vs. reward trade off for that, putting some thought into the aggravating vs. mitigating factors, and lastly doing some gut checks on if model improvement over time change the risk v reward calculus.

On paper "sandbox everything" sounds great but I haven't personally seen it work work in the general sense of "solving" Agent security. Agents need permissions to accomplish tasks. Putting them into a sandbox opens up difficult questions like "How do I provision a new identity which only has the capabilities which the tasks need" -- few systems and vendors have enough knobs needed for this -- and "If I give it access to the tools or permissions it needs can bad things happen regardless of the sandbox?". None of these have great answers with low friction. Once you factor in decision fatigue it gets worse as well.

I think if you accept that some risk is needed to accomplish meaningful tasks, that Agents are inherently statistically dangerous regardless of sandboxing, then you accept that you need statistically safety on your side. So in comes things like auto mode, system prompts which instruct some baseline behavior for your systems, being picky about model choice, and thinking about the pink elephant effect (Perhaps don't pass Haiku ambitious tasks which require unsupervised internet research and package installations while telling it at the same time to not hide its tracks if it makes an error).

The infra and identity layer is the real killer. Not all vendors and apps have as many knobs as you might like -- it would be amazing if everyone supported things like OAuth's Rich Authorization Requests. Apparently Anthropic heavily uses their cloud agents internally -- and that seems reasonable because they are all-in on it and have infinite tokens to rewrite software which doesn't work nicely there. Much harder as an individual or as a company that isn't a lab.

For me: I'm running with a mixture of both sandboxed and unsandboxed. My company has something like Claude Managed Agents internally but it isn't integrated with everything I need, cannot compile or run all of the internal stacks I work with, and doesn't have enough knobs to get the customization needed for success on my daily work.

Regardless, while my cloud agents are working away I also have things running on my machine as well for tasks which I want/need to be more hands on with. If my machine gets rm -rf'd I'll live. I dont have API keys on my machine -- everything is tokens which need to be refreshed daily. I use frontier models on high reasoning. Extremely destructive internal actions typically require step-up authentication and my Agent cannot do that itself. I have some common sense boundaries in my root AGENTS.md.

Looking around in at my company, as of a few months ago before a sandboxing solution was rolled out and before Claude shipped auto mode, around ~50% were running Claude in YOLO mode. Some large chunk of the remainder had blanket approval for "python3" and "curl" so even with manual approvals it wasn't really offering anything. Things were mostly fine -- the cases which were spread around for the dangers of agents weren't super meaningful -- examples being agents submitting bad data into a system or flipping dangerous feature flag. Frankly: Humans have done all of these as well and I think systems should validate input and feature flags should be automatically rolled back or be under step-up authorization before they change.

Could my local agents be put into a disposable sandbox? Yes but it doesn't get me much individually imho. I might put them into a more durable and reusable sandbox one day to run locally -- but until then I'm comfortable accepting the risks given my mitigating factors and the rewards I get when my 5-10 local Agents can "just do things".

That's how I use Claude for everything, because ain't nobody got time for constraints.