Yeah, I don't think that line quite landed. My point was that LLMs are inherently adversarial (read, "relentlessly proactive") and sandboxing should be a first-class integral feature of your harness, not an afterthought. The problem with dev containers is you still tend to end up with something you care about on the same side of the trust boundary as the LLM.

> LLMs are inherently adversarial (read, "relentlessly proactive") [and] you still tend to end up with something you care about on the same side of the trust boundary as the LLM

I mean this is a problem with many coworkers too, so you deal with it in the same way: limit what they can do to creating pull requests.