It's just a failure to understand. People treated like running agents is like running any other pieces of software you wrote. You don't normally need to defend from attacks from pieces of software you wrote. It's basically treated as almost completely trusted. If you just treat it like it's possibly compromised and put up some minimal walls around it then it won't break out.