[dormento]

I think the key to really "unlock" these things is to separate as much as possible from where it can do harm (no important credentials, no shared identify, etc) then just give it its own home folder, its own credentials and let it rip.

You could technically instruct the agent to pilot local ollama and launch minions for "dumb" tasks in parallel, but i don't know if it could break out and modify the file system this way... but then, if it resides say in its own VPS, the damage will be contained.