this should be sandboxed by default, running agents directly on the host is a horrible idea.