If it can be fooled, then what matters is what the operating system will let it do.
Sandboxing an agent
Having the operating system fence in an agent's commands: which files they can touch and which other machines they can reach. It holds even if the agent is fooled, because it's enforced from outside the model.
Instructions are requests, and a sandbox is a wall. It only works as a pair, too. A filesystem rule without a network rule lets a key be read and sent. A network rule without a filesystem rule still leaves your machine open to change.
Say it to your agent
“Run this agent with the sandbox on, deny reads on ~/.ssh and ~/.aws, and allow network only to registry.npmjs.org. Then test it: have it try to cat a fake key and curl an address off the list, and show me both refusals.”