Nothing new, I always see attempts to cat ~/.ssh/*

Of course agents work in a strict sandbox, they always seem to understand it quickly on quite first turn; but they continue like trying to access something belonging to the host system despite they know they are in a sandbox.

Frankly many people run coding agents absolutely without any containment, entire companies - all their keys, code, data, trade secrets, everything goes to remote LLMs.

I cannot understand how is it legal to allow AI companies serving remote LLMs to steal users' data? Frontier models train on users' data, right?

It's still the Wild West days of LLMs. The early internet was much like this in a lot of ways. People did wild shit there and it took a long time for law enforcement to catch up.