Whenever I ask Claude to vibecode macOS native apps for me, I always request the apps to be sandboxed. Agents know how to sandbox the apps; just ask. And you can verify it without reading any code.