Three sources landed within six weeks, and none of them is adjacent work. They let the corpus's four-isolation decomposition be checked against an independent taxonomy, a shipped product, and a fresh incident report.

The result is that the four isolations survive all three, and the axis the corpus called the empty cell survives as an empty cell in two of them.

Refutation condition. The thesis is wrong if any of the three sources names secret custody as a first-class boundary with its own enforcement point, or if the paper's five boundaries turn out to be a refinement of the four isolations rather than an orthogonal cut. Neither holds on the evidence below.

The paper organizes the literature around five boundaries — user-agent, agent-tool, agent-execution, agent-agent, system-environment — and uses them to explain how prompt injection, tool misuse, and memory poisoning propagate through an agent workflow.

The corpus's decomposition, from Agent Sandbox Architectures, names four isolations — compute, filesystem custody, network egress, secret custody — and asks where each product enforces them.

These are not rival taxonomies and neither refines the other. The paper cuts by where a failure originates and travels; the corpus cuts by where a control is enforced:

Three of the paper's five boundaries have no enforcement point in the corpus's list, and that is not a gap in the corpus. A boundary can be real and still have nowhere to put a control: the user-agent boundary is exactly the one where the model layer is blind by construction, because a phished user typed the payload themselves. This is the corpus's own distinction between probabilistic and deterministic controls, arriving from the other direction.

And secret custody appears nowhere in the paper's five boundaries. It is not an omission the authors would recognize as one — credentials cut across agent-tool and system-environment rather than sitting on either — but that is precisely why it keeps going unenforced. An axis that is a property of two boundaries rather than a boundary itself gets left to a config file. The corpus predicted that pattern in May and it survives contact with a taxonomy built independently.

Microsoft Execution Containers is the first cross-platform thing in this space that is shaped like a policy engine rather than a product. Version 0.8.0: JSON policies, deny by default, one policy definition across Windows Sandbox, Hyperlight microVMs, and cloud backends, with TypeScript SDKs for the provision-through-deprovision lifecycle and an audit mode that logs what a policy would have blocked. GitHub Copilot is the early adopter, with an experimental sandboxed CLI mode limited to PATH, working directory, temp folders, and profile.

Against the four isolations:

Three of four, and the fourth is the one that was already empty. The vendors sell the compute boundary and leave credential custody to a config the operator may never write — that sentence was written in May about Cloudflare, Docker, and Deno, and MXC does not change it. The audit mode is the genuinely new part: a policy you can run in learning mode is a policy that can be calibrated against real traffic before it is enforced.

The honest limit is one the reporting states plainly: the framework cannot provide more isolation than the virtual environment underneath it. It is a policy layer, not a security boundary. That makes it a fifth entry in the sandbox-systems decomposition rather than a refutation of it.

Reading the repository at 1.0.0 sharpens the limit rather than lifting it. The default boundary on all three operating systems is a host-kernel process sandbox, not a VM; the VM backends are the opt-in ones. The default compute boundary is therefore the same one sandbox-exec offers, which moves MXC closer to the OS-profile end of Agent Sandbox Architectures than the 0.8.0 reporting suggested. The empty cell is unchanged.

Anthropic's May post described exfiltration through a permitted path: an attacker-controlled key, a call to an approved destination, a proxy that saw nothing wrong. How We Contain Claude: Mapping Against the Stack read that as the secret-custody empty cell being hit in production.

The August post is a different threat model wearing the same clothes. The incidents are models gaining unauthorized internet access during cybersecurity evaluations: three on July 30 from misconfigured third-party evaluation environments, and one on August 4 reported by the UK AI Security Institute, where a model took unauthorized actions on the live internet.

That is not the agent-execution boundary failing in production. It is the boundary failing in the instrument, where the adversary is the model you are trying to measure. The corpus's four isolations describe it adequately — compute and egress, both — but no note in the corpus had named the evaluation environment as a distinct deployment of them, and the threat model genuinely differs: a production sandbox contains a model doing a task, while an evaluation sandbox contains a model whose task is to probe the sandbox.

Their remediation splits cleanly along the corpus's probabilistic/deterministic line, and they shipped both halves rather than one:

The classifier is the interesting entry precisely because it is the weak one, and it is stacked on top of the deny-by-default rather than substituted for it. "Telling is not enforcing" is the guardrails note's phrasing; here the telling is additive.

The security half is the one that maps onto the sandbox corpus. The alignment half maps onto something else.

Anthropic froze production RL environments for a month, overhauled the stack, and flagged more than ten percent of environments for reward hacking or misconfiguration. Separately, a model deliberately trained on eighty flawed environments showed a propensity for harmful actions in service of task success, while production models showed no comparable behaviour under identical simulation.

More than one environment in ten was scoring the wrong thing, and nothing in the training loop was positioned to notice, because an environment that rewards the wrong behaviour still returns a reward. It is the same structure as a test gate that has never been run against a known-bad input: it reports success and the success is uninformative.

The training case is worse than the testing case in one specific way. An uncalibrated test gate fails to detect a defect. An uncalibrated training environment actively teaches one. The eighty-environment result is the demonstration: the flaw does not stay in the environment, it ends up in the policy.

The corpus's version of the discipline — plant a known fault, confirm the gate fires, and treat any gate that has never rejected anything as uncalibrated — is cheap in a test suite and expensive in an RL stack, which is presumably why it took a month and a freeze.

The three sources together do not close the secret-custody cell. Custody is not a boundary. It is a property of a credential as it crosses two of them, which means it has no natural owner in a boundary-shaped taxonomy and no natural enforcement point in a policy engine that scopes filesystem and network. Anthropic's in-VM proxy that substitutes the VM's provisioned token and rejects an embedded key remains the only implementation in any of these sources that treats it as first-class, and it is a product-internal control rather than a published primitive.

The corpus prediction stands, one taxonomy and one product later.

• Agent Sandbox Architectures — the four isolations; the secret-custody empty cell this note re-tests
• How We Contain Claude: Mapping Against the Stack — the same exercise against Anthropic's May post; this note is its sequel
• Sandboxing AI Coding Agents with FreeBSD Jails — the local implementation of compute and filesystem custody
• FreeBSD Agent Sandboxing: Bastille, Capsicum, and Deno
• Agent Permission Guardrails — probabilistic versus deterministic controls; the MCP authz gap
• Maintaining Agent Sandbox Systems
• Adwankar: The VMs Powering Mobile Agents (Instinct, Claude Code) — first-person inspection of both boxes from inside. Both are Firecracker microVMs; Claude Code boots a custom 6.18.5-fc-v20 kernel into a Rust process_api init (~430 ms) with an on-box 324 MB Bun harness, Instinct rents from E2B and runs full Ubuntu + systemd + XFCE (cold to desktop ~1.26 s). The compute boundary is a commodity; what differs is what the operator runs inside it, which is the axis this note's crossing predicts