[sarkarsh]

xixyhuang nailed it — container escape is a red herring. The real problem is that your agent holds your OAuth tokens and can do massive damage without ever leaving its sandbox.

What bugs me about the current discourse is everyone focuses on where agents run and what they can access, but almost nobody talks about reconstructing what they actually did after the fact. Aviation has black boxes. Finance has audit trails. Agent systems have... logs the agent writes about itself. That's like asking the pilot to self-report the flight recorder.

Until action logging happens outside the agent's own process, none of the sandboxing stuff matters much.