The sandbox that isn't a sandbox

§1 What this environment is for

Read the process tree before reading the findings. It settles the threat model.

PID 1   /bin/bash ./start.sh
PID 5   nginx: master process          → :8080  ingress + auth bridge
PID 6   /app/control-plane-api/…       → :8000  Go orchestration API
PID 47  npm run dev --host 0.0.0.0     → :3000  Vite dev server (the user's app)
PID 19  tail -f /dev/null                       keeps PID 1 alive

That is a web application host. start.sh templates an nginx config, starts nginx, starts a Go control plane, waits for /health, then blocks on tail -f /dev/null until a signal arrives. There is no tool dispatcher, no subprocess broker, no policy gate on execution.

§2 Substrate

gVisor, and what gVisor looks like from the inside.

Two artifacts confirm gVisor rather than a conventional container, and both are useful fingerprints:

• df /var/log returns Function not implemented — an unimplemented syscall path in the gVisor gofer, not a permissions error.
• The CPU model reports as unknown. gVisor synthesises /proc rather than passing host CPU data through.

§3 Where the security work actually went

The nginx Lua auth bridge is the most engineered component in the environment, and the audit reports mostly skip it.

All ingress lands on nginx :8080, and every request to / passes through access_by_lua_file /etc/nginx/user_auth_verification.lua — annotated in the config as strictly necessary and never to be removed. The script:

• looks for an auth token in a cookie, then in a query parameter;
• if absent, redirects to aistudio.google.com/applet-auth-bridge with the applet ID and a return URL;
• validates the token against the bridge with a bounded retry loop, to absorb token-minting replication lag;
• caches validation results in a lua_shared_dict, with separate TTLs for public and unique tokens;
• rejects javascript: return URLs explicitly;
• carries a dedicated fallback for iOS Safari, which blocks document.cookie in cross-site iframes even after a storage-access grant.

Only after that does traffic reach the Vite dev server on :3000, with an AI Studio iframe script injected into the HTML response. The control plane is exposed under its own prefix and proxied to :8000.

§4 Networking and egress

The absence of any RFC-1918 address, and the reliance on link-local 169.254.x.x interfaces, is the standard signature of GCP serverless networking. Egress is entirely open: the environment makes ordinary outbound TLS connections with no interception, which is the opposite of both Anthropic postures and of Kimi's browser-only proxy.

§5 Findings, recalibrated

The original audit rated two findings "high". Neither survives contact with the evidence in the same probe.

§6 Software environment

The toolchain is narrow and deliberate: full-stack JavaScript with Python alongside. Nothing here supports systems work, which is consistent with §1.

§7 Evidence quality

This is a self-probe. The same caveats apply as to every other environment audit in this series.

§8 Summary

The instructive comparison is not "is this weaker than Claude's sandbox." It is that two products can share a substrate class and diverge entirely on where they spend their security budget. AI Studio spent nearly all of it on ingress. That is a coherent choice for a preview host, and a poor fit for the execution-sandbox role it is increasingly asked to fill.