An agent does something different every run, and it needs a model, some tools and an API key. Run it on your development machine and it can reach your network and your secrets, and you have a problem. Lock it in a sandbox and it can't do anything.
There is a middle ground.