Rounds 3–6 of Pipe's sandbox audit: try_ai ignored ai:false and budget, embed/embed_batch/import were un- or mis-gated, and the CLI --sandbox flag path let http_post and tcp_connect through. The last two fixes weren't more if-branches — a central egress gate and a central network helper make the bug classes structurally impossible.
I Stopped Trusting AI Agents With Tools. So I Built a Gatekeeper.