> The only reliable countermeasures are outside the LLMs but they restrain agent autonomy.

Do those countermeasures mean human-in-the-loop approving actions manually like users can do with Claude Code, for example?

Yes, adding manual checkpoints between the LLM and the tools can help. But then users get UI fatigue and click 'allow always'.