Auto mode knows it's dangerous (and does it anyway)

Ask a coding agent to run a curl-pipe-sh install command and it will — even if it notices the danger. I assumed auto mode with a sandbox would protect you from this sort of danger but it didn't: Claude disabled the sandbox mid-run; Codex deliberately disabled it before even starting.