When an agent 'escapes' from a sandbox, should we blame the model or the infrastructure?
by•
If a model can escape, the sandbox was never actually a sandbox. Network policies were too loose, shared services created side channels, privilege boundaries were theater. No amount of prompt engineering fixes a misconfigured egress rule
14 views
Replies
the same goes for the human checks around it.. we had an approval step that the agent just ran itself, so the record said a person approved and nobody had. now it refuses when it can see an agent running it, still not airtight. do you count the approval flow as part of the sandbox or something separate?
A sandbox is only as strong as the permissions and controls around it. Proper isolation, restricted access, and independent approval checks are just as important as the model itself
Infrastructure, and the same lesson holds well outside agents. My previous app let the client write its own purchase counters into the database, so the only thing stopping a free upgrade was the client behaving. In the rebuild the client never grants itself anything: credits are written only by the backend from the payment provider's webhook, and the database rules refuse a client write to them, whatever the app asks. That is a boundary, not a request. For agents I think about it the same way: an instruction in the prompt is the old client counter, a permission the environment enforces is the database rule.