You can give the LLM a bash without giving it the full /usr/bin.
That's been a trivially solved problem for decades.
That has been one of the most common exploits for decades.