Yes, indeed... and I am torn between these options. I both realize very well the potential of the Lethal Trifecta that is possible and on the other hand, if i really want effective VA (virtual assistant), I am forced to make trade offs. So far I haven't gotten burned but I will also not let my agent read my emails before me nor do it on automated basis, so there is no easy prompt injection, furthermore, I do count on the auto mode and my operating guide to not allow any actions that actually submit data outside (sending emails, uploading files etc). But it is not ideal. I see Claude Code in Desktop introduced a new environments option so I will be checking that one up. But for short, my biggest deal breaker in Cowork was no way to let the agent access my 1password cli op.
