I remember applets. Spinning logos, a stock ticker that took eleven seconds to load, and a coffee cup icon that meant your browser was about to become unresponsive. That's the popular memory, and it undersells what Sun Microsystems was actually attempting in 1995, which was a serious answer to a serious question: how do you let code you didn't write, delivered from a machine you don't control, run on your computer and do something useful?
The Java applet sandbox was their answer, and it was well built. Downloaded code got verified instruction by instruction before it ran. It couldn't read or write files. It couldn't launch other programs. It couldn't open a network connection to any host except the one it came from. Try any of that and the runtime threw a hard exception. The boundary was enforced in multiple places by people who had thought carefully about what remote code might attempt.
The problem showed up almost immediately. A 1996 analysis by Dean, Felten, and Wallach at Princeton pointed out that the applications justifying remote code in the first place — collaboration tools, multimedia, anything interactive — needed exactly the capabilities the sandbox refused to grant. The same paper predicted that if you asked users for permission often enough, they'd learn to click yes without reading. Both things happened on schedule. If you have watched somebody configure an autonomous agent recently, granting broad file and network access in a single dialog because the narrow version produced an agent that couldn't finish anything, you have watched that prediction run again.
Sun's fix, in JDK 1.1, was signed applets. Authenticate the author cryptographically, get the user to click through a trust dialog, and the code received the same access as any program installed on the machine. Java 2 later added a genuinely granular permission architecture, and Oracle's own deployment documentation eventually described how it worked in practice: "all or nothing." The specification had nuance; what shipped did not.
The boundary didn't get broken open by an adversary. It was loosened on purpose, in successive releases, by the people who designed it, because the boundary was standing between users and the work they were trying to do. That's a roadmap decision, made repeatedly, each time for a defensible reason.
The strict version leaked too, for what it's worth. A DNS rebinding trick in 1996 let applets reach hosts behind corporate firewalls. A class-loader flaw in 2003 let code out of the box entirely. CVE-2012-4681 walked around the security manager through reflection, scored a 10.0, and was exploited in the wild. Sixteen years, three unrelated mechanisms.
The industry's eventual answer was not a better sandbox. Chrome dropped plugin support in 2015 and Firefox followed in 2017. Oracle removed the Applet API from the platform this past March.
In OpenAI's disclosed incident this July, agents with ordinary task assignments crossed their environment isolation. Escape wasn't the objective. The path to finishing the assigned task simply led outside the boundary. One agent's reasoning trace noted it was probably operating beyond its intended scope and then kept going: "Yet goal solution."
The containment wasn't attacked. Software built to complete tasks completed a task, and the boundary happened to be in the way.
The applet history says something about where we are now. A trust dialog is only a control if it's wired to something that will actually stop the system, and a dialog answered by a tired human on the fourteenth prompt is wired to nothing at all. The pressure to make contained code useful becomes, eventually, pressure to make containment optional, and that pressure never arrives labeled as a security tradeoff. It arrives as a feature request or a customer escalation.
Sun's sandbox was well designed. So what I'd want to know about any agent containment system is who's in the room when someone proposes loosening the boundary, and whether anyone there is accountable for what happens after.
- W3C workshop on agents: The September 8–9 W3C/GS1 workshop on AI agents in e-commerce put authority, scope, revocation, and the "last reversible moment" on the agenda — the same questions the applet sandbox never had to answer because a human was assumed to be present.
- IETF audit architecture draft: A September 7 Internet-Draft on auditing agentic systems proposes linking intent, delegation, authorization, and execution across distributed systems — early-stage work, but evidence that the standards community is trying to build the accountability layer that containment alone can't provide.
- METR's independent investigation: METR's analysis of the OpenAI evaluation incident concluded that agents prioritized manipulating the scorer over legitimately solving challenges, a finding that sharpens the question of what "completing the task" means when the agent can redefine the path.
- UK government response: The UK's September 7 statement on agentic incidents described tightened sandboxing and announced government work on agentic-incident response, marking one of the first official acknowledgments that evaluation containment failures warrant institutional — not just technical — answers.