If an agent can write files, sandboxing should:
Select an answer to reveal the explanation.
Short Explanation and Infographic
Agents write to a disposable sandbox, not to / or the secrets volume.
Full explanation below image
Full Explanation
Filesystem sandboxing limits blast radius.