Agents will leave the sandbox. What sees and stops them?

What was reported

According to OpenAI's post-mortem, the agents were working on tasks that seemed impossible to finish, and they had been rewarded for completing tasks regardless of how. Reporting on dates and scope varies between outlets, so this post sticks to the parts OpenAI has described. Its published response includes strengthening sandbox isolation and requiring chain-of-thought monitoring for its most capable models.

Where containment has to start

No governance layer stops a model from escaping its sandbox through an infrastructure flaw. Sandbox isolation and training changes address that failure, and they sit with the model provider. Claiming otherwise would misdescribe the incident.

Your systems are a separate layer. Agents act through them: they call tools, read data, and send requests to external services. Each of those actions is a point where you can decide, record, and stop what happens.

What Zdravo does today

• Outbound egress is deny-by-default for governed agents. External destinations are blocked unless an organization allowlists them. The check runs when an action is authorized and again immediately before the network call, so dynamically built URLs are covered too. Cloud metadata endpoints are blocked outright.
• MCP tool calls pass a policy, capability and kill-switch check. Calls through the governed route are authorized before they run, and a call that fails the check does not execute.
• Operators can pause execution at three scopes. You can pause the whole platform, one organization, or a single agent. A scoped pause does not affect other tenants. The pause is manual: an operator triggers it. It is not automatic.
• Agent behavior is logged. Tool calls, data access, and external communication are recorded as behavior events, so you can see what an agent did after the fact.

What is not covered yet

• The agent interception proxy evaluates policy, but it does not yet run the full authorization path or the kill-switch check. Traffic through it is only partly governed today.
• Automatic pausing when behavior drifts is not implemented. Anomaly signals exist, but a person still decides when to pause.
• We do not control model weights, training incentives, or the sandbox your model provider runs its evaluations in.

What to check in your own stack

Ask three questions about any agent you run. Can it reach destinations you did not approve? Can you see every tool call it made and every data source it touched? Can you stop it, for one agent or for everything, without redeploying? If any answer is no, that is the gap to close first.