Containment primitives: what failed in the 2026 lab incidents and what agent platforms ship by default

The controls that failed in 2026 lab incidents included outbound access, isolation and the stop path. Nine of ten hosted sandboxes I checked default to open. In tests, mostly preprints, tool call limits held under the black-box adaptive attacks tested.