Correct and that is why bash coding agents like pi.dev got things completely backwards with their anti-minimalist bloated core tools.

No, giving the agent access to every single command on the system is not minimalist. It is actively detrimental if you want to do more than just attended coding with the agent.

I don't mind that as long as that system gets regularly wiped. If you don't wipe it, you can't reasonably measure the actual output and it's pets Vs cattle all over again, only with agents.

I love how I don't even know how many years after they were created mainstream languages haven't yet figured out that the only sandboxing that works is default deny, like Tcl or Lua.

Especially with autonomous agents, it's the only way to sanity.

We might need new OS abstractions.