I spent a long time as a younger man running general software inside ephemeral VMs. The UX was terrible, but I had no fears about browser vulnerabilities ruining my day. Ephemeral is hard, and the UX is still poor, but I did try it again a month or two back, and it's not impossible.

But now I am doing all my software development back inside ephemeral VMs, AI or otherwise - the UX there is much better, I significantly mitigate supply-chain attack risks, and agents are already constrained to a secret-less, low privilege environment, should I use them. There's a significantly higher likelihood of rogue software in third party dependency trees than there is in a small subset of programs you regularly use.

You could in theory fully review Claude Code.

But even that wouldn't be enough because LLMs are nondeterministic, and these kinds of issues are the inevitable results.

Only a mechanical, deterministic failsafe can protect you from it.

Text in a model context is not a reliable constraint.