How much of your agent's sandbox is actually read-only?

I read the Berkeley RDI writeup on agent benchmark exploits twice. First pass as leaderboard gossip....