Sandbox Escape Checklist

Review this agent execution sandbox. Assume the agent will eventually run adversarial code, either because a user asked it to or because injected content told it to.

Assess:
1. FILESYSTEM: what can it read outside the workspace? Write? Are credentials, SSH keys, cloud metadata or environment files reachable?
2. NETWORK: outbound allowed? To where? Can it reach internal services, cloud metadata endpoints, or exfiltrate to an arbitrary host?
3. PROCESS: can it spawn long-running processes, escape the process tree, or survive the session?
4. RESOURCE LIMITS: CPU, memory, disk, execution time. What happens when it hits them?
5. SECRETS: what is in the environment? Anything that should not be?
6. PERSISTENCE: can state written in one run be read in the next, and should it be?
7. HOST BOUNDARY: container, VM, or neither? Be honest about what a container does and does not isolate.

Rank findings by severity and give the concrete fix for each.

Sandbox setup:
[DESCRIBE]