And here I was thinking I was being slightly too paranoid when running plain old AI coding agents in their own VM with no credentials in it...