Expecting an agent harness to respect security boundaries is definitely the wrong thing.

We need to have easy to use auditable sandboxing of agents and their harnesses, because it's quite clear certain model providers are going to try to lock us in at the harness level, and it's those harnesses that seem most likely to go nuts.