For sandboxing and parallelizing agents people at my day job recently started using container-use[0] and seem to be quite happy with it. I have yet to try it in depth but the approach it takes seems quite sensible to me: Have the agent execute all commands within a container via an MCP[1], propagate any changes the agent makes to git branches on the host, for easy review & merge.

[0]: https://github.com/dagger/container-use

[1]: I would like it better if the entire agent process were sandboxed but I suppose that would make it difficult to use with IDE/GUI-based agents.