The Sandbox Isolates the Agent. It Doesn't Isolate the Secret.

MicroVMs and namespace sandboxes give AI coding agents mature filesystem and process isolation. Most open-source ones still hand credentials to the agent directly. Here's the proxy-injection pattern that fixes that, and what it doesn't fix.