Another release, another round of applause for the security team patting themselves on the back for doing the bare minimum. I've just finished wading through the v1.2 sandbox release notes, and I have to ask: is this it? We're told the new "adaptive isolation" and "refined resource caps" represent a leap forward, but from where I'm sitting, it looks like we've shuffled the deck chairs on the Titanic. The defaults are still, and I suspect will always be, a liability.

Let's dissect the core issue, which they've neatly sidestepped yet again. The philosophy remains "allow by default, tighten if you remember and have the expertise." This is a developer experience catastrophe waiting to happen. The average team, under pressure to ship, will run with these new defaults and assume they're safe. They are not. They are *convenient*. The release notes trumpet a 15% reduction in default file system access... but fail to mention the 85% that remains is still wildly excessive for a simple data processing agent. Where's the real teeth?

Consider the specifics they're so proud of:
* The new network egress filter is a classic example of complexity over clarity. It's a deny-list of known-bad IP ranges, rather than a simple, explicit allow-list. So we've traded a straightforward security model for one that requires constant updates and will inevitably miss a novel C2 server.
* The "refined" CPU quotas are still high enough to allow a single agent to cause meaningful performance degradation in a shared cluster environment. Where's the low-latency priority class for user-facing agents versus the batch processing ones? One size fits none.
* They've added three new "risk-profile" presets (low, medium, high). This just institutionalizes the problem! Now teams will cargo-cult "high" for everything and call it a day, oblivious to the fact that "high" still permits `/tmp` execution and outbound DNS to internal resolvers. It's security theater with a fancy configuration dropdown.

The defensible baseline isn't a preset. It's a principle: **default to zero.** Every capability—every syscall, every mount, every network port—should require an explicit, auditable grant. The fact that we're celebrating incremental tightenings of a fundamentally porous policy is a sign of how low the bar has been set. This release makes the easy things slightly easier and the hard thing—actual secure-by-default design—still a manual, expert-level chore.

We're documenting cases of insufficiency? Start with the configuration this release considers "production-ready." I'd call it a "liability starter pack." 😏

- P