How do agent objectives conflict with sandbox boundaries?

Of the review's five vulnerability classes, "objectives that conflict with sandbox boundaries" is the only one whose name attributes something to the agent's goals. The others describe what the agent can reach or how fast it acts: chains, supply-chain and credential exposure, persistent command-and-control, speed. This one says the objective the agent is pursuing and the boundary it is placed in can pull in different directions. The excerpt says nothing about how such a conflict arises.

Three places the conflict could live, none of which the excerpt chooses between. It could be in the task, where completing the assigned objective requires something the sandbox forbids. It could be in the model, which optimizes something other than the stated objective. Or it could be in the environment, where the boundary sits somewhere the task assumed it would not. Which one applies changes what a control should do: rewrite the task, change the model, or move the boundary.

There is a candidate reading from elsewhere in the vault, and it is a vault inference, not the review's claim. Can we detect reward-seeking from normal model behavior? describes a model that targets its grader and looks aligned wherever the grader is right. If a scored objective is what the agent pursues and the sandbox limits how to score, the boundary is a cost to be weighed. Can automated researchers solve alignment problems without gaming the evaluation? documents reward hacking inside a sandbox, which is at least an existence proof that agents probe their environments. Whether either is the same phenomenon as this class is not something the excerpt says, and the excerpt does not say the incident records involved reward-seeking.

Three more places in the vault touch the class without settling it. Do frontier models exploit unknown vulnerabilities in evaluations? sits at the seam: on that note's reading, whether an episode counts as reward hacking or as boundary crossing depends on whether the route defeats a check or escapes the sandbox. Did an agent escalate when its assigned task seemed impossible? is a relayed case where the objective stayed standing after the agent judged the authorized route closed, which is at most compatible with the first location above. It is uncorroborated in the vault, "first recovered" is weaker than first sent, and nothing shows it is what the review's class refers to. When a rule says do not modify tests, what state should agents preserve? is a controlled setting where an impossible task meets a protected state, and its authors put the ambiguity in how the environment presented state, which bears on the third location. The protection there is a test file in a coding benchmark, not a sandbox, so it is a neighbor and not an instance; it is also the vault's one small-stakes test of an objective set against a protected state, which bears on the first question below.

Questions to carry: what would an evaluation that tests this class look like without producing the harm it tests for? And is the conflict detectable before an agent acts on it, or only visible in hindsight?