perhaps a solution would be to honeypot the sandbox. if anything touches the honey you kill the agent.

also the conclusion to use firecracker or gvisor is obvious, that's what they were made for. it's bizarre to try and escape QEMU given how many times it has been done.