> All LLMs should be treated as potentially compromised and handled accordingly.

There are no agentic tools if one follows this proviso.

I’ve been doing all my claude coding on a hetzner, if it breaks out of that and into the other vms, or somehow crawls back through the ssh connection into my machine, then I guess I would have a problem.