I built a security-first AI agent in Python — subprocess sandboxing, AST scanning, ReAct loop