I've set up a second user on my machine just for running AI. That way I have the additional layer of OS protections against it doing something like that.

>if you allow your agents to both write code and run/test it, then it's basically equivalent to running in yolo mode anyway.

I don't. I manually check the code line by line before. And also run them in container anyway.