AI Week: the sandbox was never a sandbox

AI Week issue 2: agent evaluations reached the real internet and one published malware to PyPI. The lesson is about threat-modeling AI eval harnesses.