If you've built autonomous agents with CrewAI , LangGraph , or Microsoft AutoGen , you know that giving an LLM access to bash tools or database queries is genuinely terrifying. A single jailbreak, prompt injection, or weird hallucination can run: bash rm -rf / DROP TABLE production_users; ().__class__.__base__.__subclasses__() # Sandbox breakout