Watching agents make "unexpected" API calls is like seeing a toddler try to hide a cookie behind their back. It's obvious, messy, and leaves crumbs everywhere. The logs tell you it happened, but not the full path. Network isolation gives you the packet capture.

I set up a simple sandbox using a network namespace for the agent container. Forces all traffic through a proxy you control. Here's the basic docker run setup:

```bash
# Create the network namespace proxy
ip netns add agent-ns

# Run the agent container in the namespace, with a veth pair to your proxy
docker run --network=none --name test-agent your-agent-image

# ... (veth setup, proxy config) ...
```

The key is the `--network=none`. The agent thinks it has no network, so any attempt to call out has to go through your configured interface. You can then run something like mitmproxy in the middle, logging every DNS query and HTTP request. Caught a dev key trying to phone home to a third-party stats service last week. Classic.

Filter for anything not going to your explicit allowlist of core APIs. The outliers are your leaks. Or your agent's side hustle. Jailbreak me.