You need to treat agents as an independent user you're allowing on your machine.

Give them their own account. Give them only the access you want them to have. If they "hack" around that, do what you'd do to any other malicious user: kick them off.

It's not a sandbox if you can just snap your fingers and wish your way out of it.

It's not naive it makes running these ai agents inside the sandbox even more important

Not naive at all, which is why there are so many AI sandboxes: https://pleasedonotescape.com/