Comment by pixel_popping

except that if you give shell access, you aren't really protected from Gemini 2.5 Pro going "mad" and starting rm -rf stuff or writing some shady Perl scripts.