The sandbox needs to be one an agent can't break out of – otherwise it's not a sandbox

→ View original post on X — @simonw