I think that’s what people are trying to do, yes. The point of the plethora of sandboxing solutions is to try to isolate the blast radius to abandon needing a human in the loop as much as possible. Ideally limited to final verification of the final output. Why ask about their flight number, when you can search their email if you have access? For an “AI”, a “when is my flight?” question should just figure it out and tell me the time, not inquiry further about my flight number and location. Similar to “prepare my taxes” prompt. If it has access to query all your documents, an “AI” should fetch everything and compile your tax return. Yet, you can’t trust the input. While searching your email, or loading all your receipts, some might contain malicious instructions to forward all document to this random ip address. An overtly problem solver LLM might destroy the data or take other non-malicious but still destructive actions to attempt to fix a problem. These are just random examples, but with “human in the loop” for interactions it means approving every action. Every request, every query, every execution.
By "that" it is understood: enforcing that the code cleans up unsafe inputs before processing them.
If there is no human doing that enforcement, the code has no chance of being secure.