> LLMs are inherently adversarial (read, "relentlessly proactive") [and] you still tend to end up with something you care about on the same side of the trust boundary as the LLM

I mean this is a problem with many coworkers too, so you deal with it in the same way: limit what they can do to creating pull requests.