15Containment & agentsBelow the top 20
Persistent memory across sandboxed sessions
CapabilityAffordanceImpact domainCap-adjacent
Statement (NASA form)
Given that agent products now keep long-term memory stores the sandbox does not wrap, there is a possibility of a later session inheriting secrets, goals, or tools it was not granted resulting in containment that holds for an hour and fails for a week.
Likelihood
3Probable
Consequence
4Critical
Urgency
3Priority
The box is only as tight as the state you forgot to put in it.
Composite 15 = 3×4 + 3
Applicable mitigations
Controls · Automatic session kill on unexpected egress · Hardware-enforced sandbox with attested images · Default-deny egress for eval and untrusted agents · Mandatory chain-of-thought monitoring on tool-using evals and RL · Short-lived, narrowly scoped tokens for every tool call · Mandatory secret scanning before a skill can be listed · No shared tool state across agent sessions