Given that agentic AIs have shown an ability to exploit known vulnerabilities in software, it probably wouldn't be too far of a stretch to think they could get around firewalls in one way or another.
Which takes us back to the "it's hard to properly secure non-deterministic software" point.
No, it's definitely easy enough to build a container that doesn't let LLMs out. The problem is that these AI companies are building a playpen made of wet noodles and expecting AI to stay out of trouble