Essentially, the untested brainstorming-only idea is:

  1. Make $HOME have 0751 permissions
  2. Assume the dev project exists in $HOME/foo and has
     0715 permissions
  3. Assume $HOME/foo/src is where all source code resides
     and has 0755 permissions (recursively)
  4. Install the agent tools with a uid:gid of something
     like llm:agent
  5. Turn on the setuid/setgid bits for executable(s) in
     the agent tools or make wrapper script(s) having
     same which delegate to agent tools

There is probably some "post agent use" processing that would be needed as well.

Then I wrote a small tool[1] to streamline my sandboxing.

Now, I run agents inside it for keeping my non-working-directory files safe.

For some tools like markdown linter, I run them without network access as well.

1- https://github.com/ashishb/amazing-sandbox

A few months ago I built https://github.com/Gerharddc/litterbox (https://litterbox.work/) primarily to shield my home directory from supply-chain attacks, but I imagine it could be very useful for defending against rogue agents too. Essentially it is a dev-container-like system for Linux built on rootless Podman with a strong focus on isolation and security.

A key difference to normal dev-containers is that it encourages placing your entire dev environment (i.e. also the editor etc.) inside the container so that you are even protected from exploits in editor extensions for instance. This also makes it safer to allow agents (or built tools) to for instance install packages on your system since this is not the "real" system, it is only a container.

Another important feature I added to Litterbox (and one I have not seen before) is a custom SSH agent which always prompts the user to confirm a signing operation through a pop-up. This means that things inside a Litterbox do not have unrestricted access to your normal SSH agent (something which could provide rogue actors access to your Github for instance).

Dude, really?