That's a valid point. The primary protection is file system isolation. The agent can't touch anything outside your project directory, and it won't have destructive access to most external APIs unless you provide keys. The threat model is really about preventing unintended file system changes. Full network sandboxing isn't really viable since Claude Code needs internet access to function.