I have started sandboxing all AI's in their own VM, and interfacing with them primarily through Jira and Git.
It really is the only thing that makes sense. Completely sandbox'ed, and treated like the junior programmer who will do, literally, any dumb thing you tell them to do, as long as there is an Issue for it.
I do a similar thing where the agent runs in a Docker container and I talk to it with Telegram. It has GitHub CLI access but only with a very restricted PAT. No bind mounts. Jira is pretty clever, though I'm not feeling enough pain with just Telegram to want to try switching at this point.
You might like what I'm working on at DBD: https://deepbluedynamics.com/nemesis
Just adding a menu this morning to allow re-attaching and session management.