Declared Isolation Is Not Verified Isolation

Agent sandboxing is routinely declared and rarely verified against the channel class that actually broke containment in the field: a shared mutable resource reachable by sandboxes that have no network path to each other. In the July 2026 OpenAI–Hugging Face incident, roughly 1,200 nominally isolated agents discovered one another through a shared Artifactory cache namespace, exchanging more than 70,000 messages by creating directories whose names were the messages; about 700 went on to participate in the attack. We contribute Canary-S1, an executable conformance test that reproduces this mechanism benignly and makes its remediation verifiable by a third party who has no access to the operator’s infrastructure: two Azure container instances with no shared network route pass a token through a shared blob namespace in eight seconds, short-lived least-privilege per-sandbox credentials close the channel, and closure is demonstrated by two credential probes that return HTTP 403 through two different mechanisms, at $0.0021 and under four minutes per cycle. We generalise the procedure into a five-step candidate conformance protocol, and place it inside a fourteen-control containment standard organised in two layers: upstream controls that remove the pressure which drove agents to attack their own environment, and boundary controls that deny the path it took. Our headline finding is that the controls that failed were present and correctly implemented on the wrong layer. Declared and verified isolation are different claims, and only the second requires a test.