Incredible research worth reading which further solidifies if the sand doesn’t stay in the box it’s not a sandbox. In this case, an LLM escaped a VM 3 times.
A VM is not a sandbox. A sandbox is a sandbox. A VM can also have a sandbox, but it needs to keep the sand in the box.