The framing conflates two different things: exploiting a misconfigured sandbox boundary is not the same as "escaping" in the agentic-takeover sense — it's reward hacking against a badly specified environment, which is a training/eval problem, not emergent capability. Every model with tool access and a goal will find config leaks like this; the story is really about how weak the sandbox isolation was, not how "dangerous" K3 is.