they're not really contained and they usually run fully unattended, with a start prompt.

The first one that was used to market anthropic models was run by a company that called them sandboxed with no Internet access and of course it was disclosed later that they in fact did have internet access, and they won't disclose the prompts.

insert meme of kid putting a stick in their bike front wheel here... that's how many use LLMs today. it will get worse.