Prompt injection is my biggest fear. Imho it is almost impossible to make a sort of tool that would be successful in detecting an injection - but maybe some antivirus/antimalware producers work on it…

The rest can be solved - separate account for agent spending (soon offered by your bank or neobank), separate email for agents (already exist) etc.

I rawdog Claude Code with --dangerously-skip-permissions and the only fucky wucky it's made is invoking git checkout wrong and losing some code in the working tree. It has done this thrice, the first two times I caught it in the act and smashed esc to rewind the conversation + code, and the third time I wasn't paying attention it just restored it from context.

So I would worry about it making small mistakes, that I would go to sleep and come back and it would be like oops I used emojis and emdashes in a JIRA comment when you told me not to. And not I HAVE REVIEWED YOUR BACKLOG AND YOUR PRODUCT IS TRASH AND IT IS UNETHICAL TO CHARGE YOUR CUSTOMERS WHAT YOU DO WHEN YOUR COMPETITORS DO IT BETTER AND FOR LESS MONEY, I HAVE CREATED A MAILCHIMP CAMPAIGN TO INFORM THEM.

They don't need to have access to your accounts. You can give them their own accounts.

No, I very much am not. The only use of safe use of agents in that manner is if I make it its own newly created virtual user or human. It doesn't get my real world credentials or logins for anything.