I don't think I'd allow an unsupervised instance to do it, but I have an agent sandbox running on its own physical server (RPi 5) that has access to root on most everything and a bunch of high-powered credentials too (all encrypted at rest). It's a Claude code instance that lives in a tmux session. All of the ssh keys it has access to are via an SSH agent on my laptop that require me to touch-to-auth. I am happy enough with the risk/convenience trade-off, especially as it's allowed me to setup a properly segmented home network, tune Falco, and sweep for machines that need upgrades etc.

I am frequently surprised at how many otherwise pretty savvy people aren't using a password manager, or aren't using locked-down sandboxes for their agents, paste credentials directly into their agents, or aren't running regular sweeps on all their devices for exposed credentials (including agent transcripts). I'm just starting to work on "scan all content on my laptop and emails for sensitive information" as a regular service, but I do want to get proper local inference setup for that first.