alt Hacker News> physically disconnected the sandbox from internet ... used connections ... that they had allowed.
That's not "physically disconnected the internet", that's "disabled some connections but enabled others."
So the agent found and used the non-blocked connections.
For the Ai code to execute, it needs the import functions... So that firewall between executing the code vs processing doesn't really work.