Well, one of the other reasons I suggest running it in a strictly limited container is that you can then run it in yolo mode.

In fact, I use the pi agent, which doesn't have command sandboxing, it's always in yolo mode, I just run it in a container and then I get the benefit of not having to confirm every command, while strictly controlling what I share with it from the beginning of the session.