Surely if agents can't be contained, then neither can anyone using an agent to excape a container.
Sure, if it already has access to the internet where it can search for vulns
Maybe it has been trained to write code and search for vulnerabilities.