I too love and use pi agent.

But all of these agents have or had "dumb" security issues:

https://github.com/anthropics/claude-code/security/advisorie...

You probably know that since you run pi inside https://github.com/containers/bubblewrap.

Those are Claude Code security issues? And Claude Code is a gigantic vibe-coded dumpster fire with more bugs than an ant hill?

pi-agent famously doesn't even try to provide a sandbox, so obviously it can't have sandbox security bugs!

I actually think that this is the right model: The agent should not have access to anything it doesn't actually need: User files outside the work tree (except for maybe some allow-listed dotfiles), network access, real credentials, etc. Lock it down tight, and reduce exposure on multiple parts of the "Lethal Trifecta".