// I run a Telegram bot agent inside an NVIDIA OpenShell sandbox. So I spent an afternoon attacking it: 15 exfiltration and escape techniques against a throwaway copy, with the real OCSF logs for every result. What the cage stops cold, the two gaps it does not, and the L7 rule that closes the worst one.