Yet the AI can still escape the "sandbox", unless it is physically unable to connect to another computer and completely airgapped.

If the sandbox has vulnerabilities, which you can also use the AI to fuzz for. Obviously at the point in which it can talk to the internet it doesn't really matter, but there are a very finite number of zero-days that can exist in a bytecode interpreter hosting a harness.