Why would you sandbox the runtime? The harness is where things go awry when it does, when the agents have access to more than they should and start deleting stuff. People aren't expecting the weights themselves to be "infected by malware" or whatever.