The most critical part of the external phase of this incident was the first hour, when the agent escaped its sandbox by using a vulnerability within a package proxy on its sandbox’s allowlist to access the internet. While the sandbox could not reach the internet, the agent gained access to the package proxy, which did. The agent got out because the proxy could reach the whole internet, so anyone controlling the proxy could too.