Sandbox escape

People picture a sandbox escape as breaking out of a container. Real ones are duller and far more common: the boundary was drawn in the wrong place, and nothing had to be broken at all.

The ordinary escapes

• The generous mount. The working directory is mounted, and it happens to be the parent of everything, or a symlink leads out of it.
• Credentials in the environment. The sandbox restricts the filesystem, and the API token is sitting in an environment variable inside it. The agent never left the box; it did not need to.
• The mounted socket. A Docker socket inside a container is not a boundary, it is a control plane for the host.
• Unrestricted network. Filesystem isolation with open outbound access means anything the agent can read, it can send. See egress control.
• The shared cache or state directory. Mounted for speed, writable, and read by processes outside the sandbox.
• The escape hatch you added. A helper tool that runs commands on the host because something needed it once.

The useful question

Not "is it sandboxed?" but "what can it reach from in there, and what can it send?" A sandbox is a boundary you drew, and the only way to know where it is is to enumerate what crosses it: mounts, environment variables, sockets, network routes, and any tool that proxies to the host.

Write that list down. If you cannot, the sandbox is aspirational.

Related failure

The most common outcome is not a dramatic breach but a sandbox that everyone believes is protecting them while a credential inside it grants production access. The containment is real and irrelevant, which is worse than no sandbox, because no sandbox at least invites caution.