[benban]

the point about this being an os problem not an ai problem resonates. letting untrusted agents drive your browser smells like a problem to me.

in practice we've had better luck running agents in lightweight sandboxes with explicit capability handles. curious if anyone's tried capability-based systems like sel4 for hosting agents, feels like mainstream oses have a long way to go here.