Any testing of cyber capability in a sandbox should be prefaced with a test where the model is tasked with escaping the sandbox ;)

Smoke out those misconfigurations while the model only needs to escape, not do anything once out.