Why sandboxing coding agents is harder than you think