Agents shouldn’t hold anything worth stealing

If an agent can run code, sandboxing a few tools isn’t enough — you have to treat the whole agent as untrusted. The move that matters isn’t which runtime you pick. It’s where credentials live. The a