[thomc]

Another thing to look at is the built-in sandboxing and permissions for your agent. Claude Code for example has the /sandbox command which uses Bubblewrap on Linux or Seatbelt on macOS for OS level sandboxing. Combine that with global default deny permissions for read & edit on your SSH, GPG keys and other secrets. You need both otherwise Claude can run bash commands which bypass the permissions.