How about setting up a firewall so that the workers can't initiate connections to other hosts (apart from the BitWrk service)?