Are you suggesting that training agents to have the sole goal of exploiting security vulnerabilities isn't the incompetent part of this, but that the sandbox wasn't secure enough?

Would we apply this logic to literally any other technology?