Running your coding agent in bypass mode on your laptop is the mistake. A VM with Tailscale and default-deny egress is how you shrink the blast radius.