Agents can wipe your filesystem and leak your API keys. iClaw runs them in a sandbox, where they physically can't reach your real machine