Sebastian starts from a conflict every coding agent hits: setup needs the network for `pip install` and `git clone`, and execution runs model-written code in the same box, next to a credentials file. A sandbox created with egress off cannot install `requests`. A sandbox left open keeps the exfiltration route through the dangerous half of the run. His answer is one `sb.update()` call between the two phases, which he timed ten times on a running sandbox at a 127 ms median. After the lock, a POST of the fake secret is blocked, and the installed package and the cloned repo are still there. The part we would underline is his matrix of six policies applied to one live sandbox, which shows that `allow_internet_access=False` plus an allowlist also turns off name resolution. Pin addresses, or resolve before you lock down.
We didn’t write this one — it’s Sebastian Buzdugan’s piece, published on Data Science Collective. The note above is ours; the full article is theirs.