Purpose-Built Sandboxing Enables Secure Agent Execution