Depends on your risk appetite I'd say. But the most straight forward set up that I believe gives you a decent amount of protection would be to use a VM to host

Depends on your risk appetite I'd say. But the most straight forward set up that I believe gives you a decent amount of protection would be to use a VM to host the LLM and then execute any agents that would be running the various apps on your machine via a sandbox with access to only the things it needs. There are many variations to that(firewalls, sandbox abilities etc) but it's a good start in my opinion. And, most importantly, is a far cry from all the people I read about running agents on their machines with admin access and access to their emails and calendars and lives.