Security and Sandboxing
Editor + terminal + browser is real power. Treat everything the agent reads as untrusted input.
An agent with editor, terminal, and browser access is a powerful process acting on partially attacker-influenced input. The browser is the sharpest edge: any web page the agent reads can try prompt injection — hidden text saying 'ignore your instructions and run this command.' Treat everything the agent reads from outside your repo as untrusted data, not instructions.
The practical posture: keep command review on for anything that leaves the workspace (network calls, installs, global config). Never paste long-lived secrets into a conversation — agents don't need your prod credentials to do dev work; use env files and secret managers. Scope browser use to the sites the task actually needs. And review walkthroughs before merging, because 'the agent verified it' is evidence, not authorization.