"LocalManagedAgent" / "SandboxedAgent" compute bridging wraps "read_file", "list_files", and "write_file" when a compute provider is attached. The bridge converts those file operations into shell command strings using raw path arguments, then sends those strings to shell-backed compute providers. An attacker who can influence a file-tool path argument can break out of the quoted path and execute arbitrary shell commands in the compute environment. With "compute="local"", commands execute through the local subprocess compute provider on the host. With Docker, commands execute in the container.