> physically disconnected the sandbox from internet ... used connections ... that they had allowed.

That's not "physically disconnected the internet", that's "disabled some connections but enabled others."

So the agent found and used the non-blocked connections.