I made a tool to solve this problem (at least on Linux, though I believe there's a way to achieve something similar on MacOS):

https://github.com/swelljoe/flar

It uses bubblewrap to instantly construct a container around just the agent config, auth and history and the project path. The agent or any command it runs can't reach outside of it even if you tell it to (or, more dangerously, a random prompt injection from the web or some third party library or script that the agent runs).

I was using VMs to solve this problem but the temptation to start an agent to work directly on my machine for GUI apps and the like was motivation enough to find an alternative to VMs.

I wouldn't use Grok, became I really don't trust Musk, but even the models I do kinda trust to have good judgement I don't trust enough to let them have unrestricted access to my personal machines and all my credentials.

"FLAR is the Fast Light Agent Restrictor. It runs on rocks called gars."

what is rocks and what is gars?