Comment by ottah

These sanboxes are only safe for applications with relatively fixed behaviour. Agentic software can easily circumvent these restrictions making them useless for anything except the most casual of attacks.