Technically open source harness like opencode is more "malwarey" than claude code for example because its default permissions are very open.

I disagree with this, Claude code does many malware like things and has its source obfuscation. Plan mode doesn’t even work.