The threat model is unusual and that is what makes it easy to get wrong. The code is not written by an attacker, and it is not written by a trusted developer either. It is written by a model that has been reading attacker-controlled text all afternoon.
What you are actually defending against
Three sources, ordered by how often they bite:
Accident. An rm -rf with a variable that was empty, a script that fills the disk, a dependency install that takes an hour. Overwhelmingly the most common, and cheap to contain.
Indirect prompt injection. The agent reads a web page, an issue comment, a README or a log file containing instructions. That text becomes context and the model may act on it. The attacker never touched your system; they wrote a paragraph somewhere your agent would read it.
