I had a similar situation where I was convinced that Code Interpreter had escaped its sandbox but SimonW was able to reel me in, discussed here https://mastodon.social/@Jackivers/110715505542072107