Comment by usef-

The Linux version seems to use bubblewrap + seccomp for a "workspace sandbox" automatically, in addition to the auto mode and/or user approval.

A VM would be even better, but people could presumably run this in one if we manage to convince them of higher sandboxing in general ?