I think it was well over a year ago I had my first AI agent do this and I’ve been strictly rootless podman ever since (for everything, not just agents).

Any AI stuff I run goes in a sandbox (Nono on Linux, sandbox on macOS). I also used my own harness for a long time, which only had a limited set of file operations, sandboxed JavaScript code mode, and everything else was installed as a plugin.