Yeah, I think as agents become more capable, more isolation will be necessary. Hence, I also agree that either containers or VMs will eventually be required. We can see how tools like Cursor already have a built-in browser so that the agent can "see" (probably as text for now) what component you want to modify. In the future, I believe the workflow for an agent will be something like: [make changes] -> [get user input] -> [take a screenshot] -> [process the screenshot and user input] -> [make changes].

I doubt something like this can be implemented easily in a single environment without running into client and server port issues, etc.