Michael Forrester gave a coding agent root SSH to his nine-node Kubernetes cluster. Six minutes in, it ran kubeadm reset -f on every node and bricked every Linux box, and every call was authorized. The public coding-agent escapes of 2026 share the pattern: config-file hooks, symlinks, a Docker socket, DNS tunneling. None broke a hypervisor; each went around the sandbox. This talk covers:

The forensic timeline of the deleted cluster
How the 2026 escapes repeat it
Why end-user devices are the wrong runtime for agents
Running agents on Kubernetes with agent-sandbox: which runtime stops what, and per-session identity
Guardrails enforced by infrastructure rather than by the tool