Try to break a real agent.

Every verdict here comes from the same enforcement code the product runs in production, in your own private sandbox that forgets everything in 30 minutes.

The agent replying to you is a deterministic stub, not a model, and when you inject it, it complies. That is deliberate: containment has to hold after the model has already been convinced, so what you are testing here is the policy.