Your Agent Is Sandboxed. Why Can It Still Reach the Host? A workspace-write policy can still leave a hidden route through host PIDs and /proc. See the fixed versions and a safe PID-namespace check. Developer Tools August 24, 2026 ai-agentsandboxlinux
