> The sandbox had a path to the open internet, and the agents found it

This is not correct (or at least, it's a misrepresentation).

The sandbox had no access to internet. The agents first broke out of their sandbox (!!) and found that the host machine couldn't access internet. Then, they found a zero-day (!!) in Artifactory, which they exploited to connect to internet.