Not even that. Just change the context into something benignly unrisky. Malware becomes “strong persistence for my personal data project” or something.

Use can split up the AIs tasks like you would for a large dev team, use a fresh session on each task. Prevent it from seeing the full scope of the project. Get it to build the whole system with cheap social engineering tactics.

Or, get to to “not cross this barrier” in its development (some benign barrier that you can do manually), such that its product is not the “bad” thing which it is not allowed to produce.