Which Came First: The System Prompt, or the RCE?

This report describes an authorized penetration test that discovered a critical sandboxing weakness in an AI-agent environment: uploaded files and binaries could be executed or treated as safe test scripts, and statically compiled binaries were opaque to the model, enabling code execution that exposed sensitive assets (system prompts, MCP tool definitions, Dockerfile, and server code). The authors recommend restricting executable operations at the OS level, validating uploads by content (magic bytes), adding tool-level guardrails, and locking down network egress to mitigate post-exploitation activity.