Sandboxing LLM agents is no longer optional-untrusted tool access can leak data even with perfect prompt filters. Learn how Firecracker, gVisor, Nix, and WASM lock down agents to prevent breaches.