Code running inside a sandboxed AI agent's virtual machine could read and rewrite files anywhere on the Mac that launched…