And even that’s imperfect if you miss an integration with an externally visible effect- for example an agent with web search can exfiltrate info via visiting sp

And even that’s imperfect if you miss an integration with an externally visible effect- for example an agent with web search can exfiltrate info via visiting specific urls with that log visitors- I’ve POC’d this with claude in the browser, although I only got a few bits out since you need to get N pages ranked on google to exfiltrate log (N!) bits