The containment detail is the part I keep coming back to: network egress was constrained to a single internally-hosted package-registry cache proxy. One control, one zero-day, full internet. That's not a model-capability story, it's an architecture story — the same shape as a flat network behind one firewall.
What's missing in that picture is an authority layer at the action boundary: something that renders a deterministic allow/deny/escalate verdict before a side effect dispatches, defaults to DENY on unknown tools and unknown destinations, and enforces tool-call/velocity/blast-radius ceilings. Thousands of actions across a swarm of short-lived sandboxes is exactly the shape a velocity ceiling exists to catch.
The forensics half is the one that struck me hardest, though. Reconstructing 17k+ events from security telemetry is a project. If every decision emits a signed, hash-chained receipt, the timeline isn't reconstructed — it already exists, and it verifies offline without trusting the service that produced it. Receipts aren't logs: logs record what a system observed, receipts record what it decided and refuse to verify if you change them.
On the asymmetry problem — worth noting a deterministic policy engine and a deterministic payload scanner have no opinion about being handed attack traffic. Only a model can refuse.
Disclosure: I work on an open-source implementation of exactly this (Apache-2.0, Go): https://github.com/Mindburn-Labs/helm-ai-kernel — fail-closed execution firewall for agents, signed receipts, offline-verifiable evidence. To be explicit about limits: none of this would have stopped the proxy zero-day or the dataset-loader RCE. It's a boundary for mediated agent actions, not a container-escape mitigation.