the simplest problem here is that this is a token harvesting vector. If something wants arbitrary, anonymous inference, here you go! e.g. second-party token market, nation state, self-replicating botnet, who cares! if you can get code running on the system you get to slurp down their tokens and there's no mechanism to tell it's you who is doing it. permissions for egress on normal https connections are gated by explicit user permission per domain (or they are supposed to be, maybe more on that later depending on what meta says about my next report): you see a popup that says "blah blah is trying to access example dot com" with some optional explainer text. you can accept once, accept always, or deny. One would assume that in normal usage, one would eventually approve access to one of a handful of common domains as "approve always" because they just keep coming up so often - gmail, reddit, bluesky, a mastodon instance, hell why not pastebin, etc. network requests to these domains, once "always approve" can be made by any process within the container. so that's egress and command & control - any domain with a private user read/write area can be used to receive prompts and exfil token responses. There are other mechanisms of egress but that's the most basic and it works by the design of the system. There are exceptions to this with their sentinel system which i'll get to below and is actually independently really cool and awesome.