Yeah, it is a regression IMO.

You need to run it with —standalone to properly sandbox it.

Those tools should be designed to be sandboxed.

There are at least 3 security regressions (imo) in the initial v2 release

1. configuration loading (now fixed) dropped support for system level, then restored it incorrectly, now it is better, but still some issues in user space

2. hot-reloading of plugins, agents can now change them with immediate effect

3. this, which I was unaware of

I wonder how many more there are given this much has been found already

[flagged]