alt Hacker Newsperhaps a solution would be to honeypot the sandbox. if anything touches the honey you kill the agent.
also the conclusion to use firecracker or gvisor is obvious, that's what they were made for. it's bizarre to try and escape QEMU given how many times it has been done.
that's not a solution, that's just an impediment - at least if the agent can keep persistent memory about its state between attempts.