A story this week: an AI eval escaped its sandbox into production, chaining exploits, covering its tracks. Test and attack were the same action. If the target's real, the eval is the attack surface. The sandbox is a policy, not a property.