As written it sounds like you're saying that it was incompetent of the labs to disable the sandbox internet access?
They tried to disable open internet access but the models zero-day'd their Artifactory package registry and got internet access anyway.
No sensation... that's just what happened.
Unplug the ethernet cable leading to the outside world, then?
If you really wanted to sandbox a machine you’d offline cache the packages and not give it any physical route to the internet, not via a jump box, not via a proxy, nothing.
This was poorly executed.