From Dev.to
Your coding agent's worktree is not its security boundary
An agent opens a fresh worktree, completes a task, and hands back a diff. The files are separate. The result is easy to review. It's tempting to call that containment, but the worktree only separates...