It's a bad approach, it can still see the / directory, and eventually you want to give it sudo privilege or act as the root user to get anything done. Yet I really wouldn't trust these things as far as I could throw them, there is no "undo" button in the terminal.

Nah, if it needs sudo then I need to be 100% involved. I'm running Claude in dangerous mode without any "protection" just bare metal, but it doesn't ever do sudo. Python solved this need by giving us virtual environments, which is just installing packages locally instead of system wide, so zero need for sudo.