A sandbox, even if 100% secure by itself, doesn't help when you use the agent to write code that you then executes outside the sandbox without checking, which is what everybody is doing at the moment.

The biggest hurdle for a full escape is that the agents don't have access to their own model weights.