If your AI agent framework says it "sandboxes" untrusted code, that one word is doing the work of three different jobs, and most tools only do one of them.

What an agent may attempt is a policy question. Once it's running, containment needs a boundary the code itself has no control over. And knowing what it actually did needs a witness who isn't part of what's being watched. Most agent frameworks do the first job well and quietly assume the other two come free. They don't: the same process that enforces your policy usually shares a trust boundary with the code it is supposed to contain, and a log the sandboxed code helped produce is not independent evidence of what that code did.

I published a paper today surveying nine public 2025-2026 incidents where this exact gap caused a real failure, and sorting every architecture I could find that tries to solve the evidence problem into five classes, split apart by who's actually watching, whether they hold the signing key themselves or only get handed one afterward, and how much of the run they actually get to see. Almost nothing survives an operator free to simply not show you the runs that embarrass them, and that's the uncomfortable part.

This talk is the practical version, in Python terms: how to tell whether a tool you already use is doing one job or three, and the questions to ask before you trust the word "sandboxed," whether it's a vendor's claim or your own side project.