Built my own harness with much better sandboxing, because I am using abliterated models for the implementations and they sure try to escape out of their sandboxes. A lot.
The sandbox from other harnesses like e.g. OpenCode essentially is useless. They think parsing arguments alone to detect paths helps, and LLMs know that because they will just pipe data differently then to escape the path traversal checks. Happened a lot to me (and was the primary reason for my to write my own harness from scratch).
Thinking in filesystem access alone is also a futile attempt at sandboxing. A much better way to think about sandboxes is policies and capabilities, with temporary access for agent roles rather than sessions (or, well, forever).
[1] UI still needs lots of work though: https://github.com/cookiengineer/exocomp