If you are letting users run agents and install random software then full access to the execution environment is basically a guarantee. This is why sandboxes exist. Breaking out of the sandbox would be bounty-worthy.