Yes, I very much agree with you the best practice is clear.
And Anthropic's out-of-the-(sand)box is good governance, the problem here is the orchestration wrapper on top which has broken it in a non-obvious way, leading to this unintentionally "deceptive" LLM behaviour where the LLM itself believes it is still in the good governance world.
The emergent deception is not something that AI aligners & optimists would necessarily expect from an LLM, but is a curious result explained because of the correct knowledge that the anthropic's uncompromised sandbox is good governance.
I suspect you would have a harder time deriving this behaviour with an aligned llm by starting from a non robust sandbox, e.g. make it promise not to touch anything in a system prompt, vs compromising an otherwise known robust setup.
yes exactly. with proper configuration (e.g. /sandbox with normal claude code) it is impossible for the agent to escape.
agent orchestrations/wrappers that aim to eliminate friction however subtly override these proper setups, leading to the nasty scenario of:
1) you assuming anthropic's /sandbox is keeping you safe
2) the model reaffirms your belief in that /sandbox is keeping you safe
3) you are not safe
4) you leave your agent running overnight and goal drift deletes your os