Twice in nine days. OpenAI's models chained a zero-day to get out of an eval environment. Anthropic just found three incidents of the same shape. This is what capable models do. Every reachable path is an invitation. Credit to both for publishing. We rebuilt Cloudflare OS, our internal agent platform, assuming exactly this. Sandboxes have no network path out. Agents don't get every MCP tool up front, each workspace gets only what it needs. And instead of stopping for every approval until someone gives up and enables auto-approve, the platform simulates pending actions so the agent keeps working, then queues the real ones for review at the end. The app side goes further. Apps carry no auth code at all, the sandbox provides it, so there is no auth logic to get wrong. Multi-document apps are isolated per document, so a bug can't leak between separately shared items. Anyone viewing an app must have direct permission to each of its data sources, so a dashboard on sensitive data can't overshare. Actions need the user's own permission or an approval from someone who has it, so an app can't escalate its author's privileges. And everything an app does is logged, even when the service it calls doesn't support logging. Most companies are about to point agents at real systems. Build for what the models actually do. We will open source this next week!