Yes, they need to be heavily sandboxed. On my machine, LLMs are constrained to docker containers for me, no exceptions.

Launch script checks that I can't accidentally run them with a working dir too far out (i.e. user folder).