No, the internet access was down to finding a 0 day exploit in artifactory. However this was only get requests and they had to then use a url shortener to use other methods, then used a cybergym instance they found to run more long running things.
It not just a case of saying “pls don’t”
You are incorrect. The article explicitly mentions the crawler/screenshotter service and httpbun.
That's also my understanding.
This part of the article describes it poorly:
> The agents initially had very limited access to the internet: they could load URLs
Yes but that wouldn't have worked if there were a firewall denying network access.