[ottah]

These sanboxes are only safe for applications with relatively fixed behaviour. Agentic software can easily circumvent these restrictions making them useless for anything except the most casual of attacks.