Google's CAPSEM puts each coding agent in an isolated VM and keeps credentials outside it. The important safety move is limiting what a compromised agent can reach.