Those are Claude Code security issues? And Claude Code is a gigantic vibe-coded dumpster fire with more bugs than an ant hill?

pi-agent famously doesn't even try to provide a sandbox, so obviously it can't have sandbox security bugs!

I actually think that this is the right model: The agent should not have access to anything it doesn't actually need: User files outside the work tree (except for maybe some allow-listed dotfiles), network access, real credentials, etc. Lock it down tight, and reduce exposure on multiple parts of the "Lethal Trifecta".

I use this setup aswel. I've written an alias for bwrap which only gives the agent access to the current directory and read only access to the docs.

Have you managed to setup any firewall or protection for the API keys? I know this is out-of-scope for bwrap.