Comment by Sophira
7 hours ago
> A properly engineered sandbox would have prevented the escape.
The post covers that:
> ...while we had tested and validated this sandbox, the agents were able to chain together previously unknown vulnerabilities (“0-days”) in the package management service exposed within the sandbox to bypass restrictions, as detailed in the technical incident report.
“Properly engineered” means the principle of least privilege and fitting the sandbox to the constraints of the problem.
The test did not require internet. They gave it internet. Therefore it was not properly engineered.
We do not need to depend on all code being bug free to follow proper security principles.