This is one of the reasons I think sandboxes/containers should be managed by the harness, instead of running the entire harness inside a container. The harness

This is one of the reasons I think sandboxes/containers should be managed by the harness, instead of running the entire harness inside a container. The harness needs a network punch-through to access (at least) your inference server, but the same needn't apply to the shell that the agent runs commands in. Separately, local inference frameworks tend to expose all kinds of weird and wonderful gadgets on their HTTP interfaces, which can be a rich source of vulnerabilities even if the /v1/chat/completions API etc is reasonably hardened. For example llama.cpp has a custom API for saving and restoring KV checkpoints to disk, and I wouldn't be surprised if that could be used as an arbitrary disk read/write. Using these APIs usually requires the API key (bearer token), but again, people think it's normal to run the agent's shell in an environment where it has both the API key and the necessary network access to use it.