Comment by bilekas

> Note: Cortex does not support ‘workspace trust’, a security convention first seen in code editors, since adopted by most agentic CLIs.

Am I crazy or does this mean it didn't really escape, it wasn't given any scope restrictions in the first place ?