Evaluating Containment of AI Agents: A Nine-Rule Standard for Verifiable Sandbox Security

I thought this was one of the more directly useful submissions for the containment track. I especially liked that you worked backwards from the actual July incident rather than starting from a generic sandbox security checklist. Turning the crossed boundaries into nine executable checks makes the proposal much more concrete and gives a third party something they can actually test.

The red-teaming was also a strong part of the submission. I think the fact that your initial checks looked reasonable but adversarial testing still exposed 17 bypasses is a useful result in itself. It makes the case that a containment standard should not just have checks, but checks that have themselves been attacked.

For the innovation dimension, I think the most interesting contribution is the incident-grounded methodology and executable audit harness, rather than the individual security controls. Default-deny egress, non-root workloads, metadata isolation, credential scoping, and control-plane separation are all established practices. I would make it even clearer that the innovation here is how you translate a real incident into a reproducible containment test suite.

I would also be interested in seeing this tested beyond a reconstructed fixture environment. Right now the checker mostly evaluates declared configuration, and as you point out, a real deployment can drift after passing the audit. A natural next step would be running the same rules against a live cluster or against other incident classes.

Overall, great project! :)

The best Track 1 fit in this batch: nine rules, each tied to a boundary the real attacker crossed, with offline checkers anyone can run without lab access. The red team round is the standout — finding 17 bypasses in their own checkers and reporting that Rules 2, 6 and 7 only looked sound until adversarial fixtures hit them.