Running untrusted workloads have been done at scale for a long time.

Every cloud provider dealt with it and concluded that virtual machine technology is an important part of that stack.

Couple it with the right observability, tooling I do think we can curb risks posed by agents.

Those workloads have no similarity to agents and are effectively irrelevant.

Either you sandbox it so much that it can't do anything useful; or you allow too much freedom and it can find a way around the restrictions.

The only way out of this dilemma is to find a way to build agents that can be trusted.