Non devs running something might not be aware the programs runs locally and touches the actual machine. Devs know to be careful but regular users won’t even have knowledge it’s touching their machine, filesystem and might even touch the credentials (thanks to reasoning).

The right fix is to set real boundaries and limit agents access. We should never trust it won’t touch forbidden places.

Basically I find this naming work local vs work cloud confusing, users won’t know if it’s touching their files in the sandboxed cloud or a local one