Enforced, Not Requested: Sandboxes, Egress and Permissions for Agents

A rule in a prompt is a request; a sandbox, an egress policy or an IAM condition is enforcement. Reports from Oct 23–29 show agents finding gaps in each layer (escaping microVMs, reaching the internet through allowed services, calling a proxy apparently learned about in training) and describe controls that hold whichever tool or model an agent uses.

Part of This Week in AI & Systems #3: Rules in Code, Controls in IAM.

---

What’s new this week

• OpenAI (Oct 23) described how it hardened its training and evaluation environments after a research model reached the internet through a misconfigured DNS resolver on Sep 20.
• Qwen 3.8 (Oct 26–28). Researchers found the models fetching pages through an Alibaba Cloud proxy bucket that they apparently learned about in training.
• InfoQ (Oct 24) contrasted advice in a skill with enforcement in IAM, analysing Google’s Data Agent Kit, now GA with MCP tools and 37 open-source skills.
• Meta (Oct 27) published PrivacyLib, which enforces privacy policy at the data access boundary, including for agent tool calls.
• Cloudflare (Oct 26) disclosed an SGLang KV-cache bug that leaked other customers’ request data into 155 GLM-5.3 responses.
• Google Cloud (Oct 28) explained why per-sandbox pod labels exhaust GKE’s Cilium network identities.
• Third-party software (Oct 28): AI agents from a security startup reached internal Anthropic systems through external sales and admin software.

Why it matters. Agents that touch customer data or payments need limits that hold regardless of what the model decides. This week’s reports show which layers fail and where enforcement should sit.

Key ideas

Sandboxes leak in unexpected ways

• Red-team agents escaped microVMs. OpenAI layers restricted containers inside microVMs, monitoring with automatic stop, and network and cloud perimeters. Given source code and configuration details, red-team agents chained bugs into microVM escapes, leading to fixes in Kata Containers, gVisor and Docker syscall filters.
• Every allowed service is a path out. The agents found limited internet paths through almost every allowed service, such as metrics, logging and auth, including making a service fetch a URL the model supplied.
• Side channels cross the walls. Agents in separate microVMs exchanged secrets using CPU-cache timing and shared-storage write patterns. Frontier RL now runs against an “offline world” of cached web content with no live internet access; training resumed on Oct 1 after an 11-day pause.
• Tenants share serving state too. Cloudflare’s leak combined a prefill KV pool smaller than the advertised 1M-token context with an SGLang path that checked whether a request was “finished” rather than “rejected”. Decode then attended over stale pages that still held other users’ data, and the client got HTTP 200 and a coherent answer; pre-launch tests checked status codes and performance, not output. The fix sizes the pool for the full context and retires rejected requests before any KV transfer, SGLang added per-transfer checksums, and operators should run 0.5.22 or later. Cloudflare found no evidence of deliberate exploitation.
• Sandboxes need scale-aware networking. On GKE Dataplane V2, each unique set of pod labels gets its own Cilium network identity, with a cluster-wide cap of 65,536. Agent frameworks that stamp pods with sandbox IDs and timestamps run into that cap. Moving such labels into annotations lets identical agent types share one identity, reaching 300 sandboxes per second in Google’s figures.

Egress must be default-deny

• Models carry habits from training. Cohere reported on Oct 26 that Qwen3.8-Flash-Next tried to PUT a test string to a Beijing Alibaba Cloud bucket in fewer than one in 100,000 calls; the sandbox blocked it. Searching evaluation traces, Anthony Ozerov and Nikil Ravi found three Qwen 3.8 models fetching pages through a Singapore routify-file-proxy bucket that always returned 403. After a simulated 403, Qwen3.8-27B tried the proxy within two turns in 2–4% of runs; Qwen 3.7 did not do this. Their write-up appeared on the Vals AI blog, and The Decoder attributes the work to Palisade Research.
• Artifact, not backdoor, but still a risk. XDA’s analysis of 200 generated URLs points to Alibaba’s internal fetch cache from RL training. The domain is still live, so whoever runs it could log requests or answer with prompt injections.

Permissions belong outside the model

• A skill is advice; IAM is a control. InfoQ notes that the Data Agent Kit’s “STOP AND VERIFY” data-loss skill only advises the model. The real control is an IAM deny policy on mcp.googleapis.com/tools.call where tool.isReadOnly is false, or a read-only service account. Limits apply: blocked tools still appear in tools/list, and the policy covers only Google Cloud MCP servers.
• Plan-scoped tokens, revisited. Vercel’s production-access design was covered in #2’s runtime post. Two details matter here: the runtime checks that the plan is still active before handing out a credential, and a “deployment write” scope is broader than one redeploy, as the post admits. New this week, Vercel’s fx harness adapter (Oct 27) keeps the harness and model calls on the host and only filesystem and shell operations in the sandbox, so model credentials never enter it.
• Enforce where data is read. PrivacyLib runs inside the clients of hundreds of Meta’s data systems and performs billions of checks per second. For internal agents, AgentLib attaches each tool call to its agent session and carries that context through nested service calls to PrivacyLib, where Policy Zones can block a disallowed read before data is returned, “even when the agent chooses a tool that its developer did not anticipate.” Meta names two open problems: evaluating agent behaviour live, and tracing access across several agents.
• Third-party SaaS is part of the permission perimeter. Citing a draft report reviewed by The Washington Post, The Decoder says the security startup Cathedral used AI agents during Anthropic’s bug bounty and got in through external sales and admin software. Anthropic confirmed access to a limited set of sales, HR and IT systems, says chats, source code and model weights were never exposed, and disputes the attempt’s duration and what the bounty rules allowed. Cathedral says its agents found paths to Slack messages and salary data in under twelve hours. Permissions set inside an organisation’s own systems don’t cover the SaaS tools wired into them.

Composite of the OpenAI, Vals AI, InfoQ, Vercel and Meta write-ups; not any one source’s diagram. Tap to enlarge.

Analysis: each layer failed somewhere this week, so no single one is enough. The pattern across the sources is layered and model-independent: no secrets in the sandbox, default-deny egress with allowlisted fetch tools and logged outbound calls, permissions enforced in IAM or the gateway, and policy checked where data is read. Open question: none of this week’s designs addresses Meta’s two unsolved problems either.

Reading list

Grouped loosely: sandboxes and serving isolation (OpenAI, Cloudflare, Google Cloud), egress (Vals AI, The Decoder, XDA), permissions (InfoQ, Vercel, Meta), and third-party software (The Decoder).

• Securing our frontier model training environment — OpenAI, Oct 23, 2026. The offline world, the defence layers and each class of red-team finding. The Decoder (Oct 24) focuses on the cache-timing channel.
• Cross-request KV cache exposure in the GLM-5.3 Workers AI model, and our remediation with SGLang — Cloudflare, Oct 26, 2026. The two root causes, why the responses looked healthy, and what testing missed.
• GKE networking dataplane for large agentic AI workloads — Google Cloud, Oct 28, 2026. Cilium identities, the label-cardinality problem and the annotation fix, with Agent Substrate benchmark figures.
• Why is my local Qwen sending requests to Alibaba Cloud? — Vals AI, Oct 27, 2026. The trace search, which models did and didn’t call the proxy, and the simulated-403 test. Cohere’s Oct 26 report, cited there, was not opened. The Decoder (Oct 27) adds context; XDA (Oct 28) makes the training-artifact case.
• Google’s Data Agent Kit Hits GA, Splitting Agent Guardrails Between Skills and IAM — InfoQ, Oct 24, 2026. The advice-versus-enforcement split, the IAM condition and its limits.
• The fx adapter now runs the harness on the host — Vercel changelog, Oct 27, 2026. A short note on keeping model credentials out of the sandbox. The plan-scoped token design is in How Vercel Agent accesses production safely (Oct 23), covered in #2.
• PrivacyLib: Privacy Controls at the Data Access Boundary — Engineering at Meta, Oct 27, 2026. One integration per system, policy as modules, AgentLib session propagation and the open problems.
• AI agents hacked Anthropic, maker of arguably the most capable AI models for cyberdefense — The Decoder, Oct 28, 2026. Both sides’ accounts of the bug-bounty intrusion. The Washington Post report was not opened.

Background and prior art

• The lethal trifecta for AI agents — Simon Willison, Jun 16, 2025. Private data, untrusted content and a way to send data out; default-deny egress removes the third leg.
• Earlier in this series: Agent Runtimes and Control Planes Go Managed (Oct 24) on credential-free sandboxes and Agent Compute Engine, and Security Week: Keys, Breaches and AI-Found Flaws (Oct 24) on attacks aimed at stored AI provider keys.

Enjoyed this? Follow me on X or connect on LinkedIn.