docs: constrain sandbox egress guidance

Clarify the editor boundary, require deliberately bounded egress, qualify Jailbox as one verified reference pattern, and remove the duplicate AWS bulletin citation.

the-security-guide.md

@@ -163,9 +163,11 @@ docker run -it --rm \
 
 No network. No access outside `/workspace`. Much better failure mode.
 
-Three limits are worth naming. A container shares the host kernel, so it is a weaker boundary than hardware virtualization. The agent can sit inside the container, as it does above, while the editor you open the repo with does not. In 2025, malicious code reached version 1.84.0 of the Amazon Q Developer VS Code extension, although AWS reports that a syntax error prevented it from executing. A container around the agent would not have isolated an editor extension running on the host. And `internal: true` is the right default, but the agent needs its model API, package registries, and git remotes, so you open a route out on day one.
+Three limits are worth naming. A container shares the host kernel, so it is a weaker boundary than hardware virtualization. It also protects only what actually runs inside it: with VS Code remote development, workspace extensions may run in the remote environment while UI extensions remain local. In 2025, malicious code reached version 1.84.0 of the Amazon Q Developer VS Code extension, although AWS reports that a syntax error prevented it from executing. A container around the agent would not have isolated an editor extension running on the host.
 
-The path of least resistance is to open all of it. A narrower version is a VM that holds the editor and its extensions alongside the agent, reaches the internet, and has no route to the host, the LAN, or any private address. [Jailbox](https://karamatli.com/posts/network-isolated-kvm-sandbox-ai-agents/) is one concrete KVM-based reference architecture for that pattern.
+Keep `internal: true` when the work can stay offline. When model APIs, package registries, or git remotes require network access, add only a deliberately constrained egress path. Allowlist the required destinations or proxy them, block host, LAN, private, link-local, and metadata ranges, and verify the boundary from inside the sandbox. Attaching a general-purpose network restores broader reachability and should be an explicit exception.
+
+A stronger version is a VM that holds the editor and its extensions alongside the agent, reaches the internet through a verified policy, and has no route to the host, the LAN, or other private addresses. [Jailbox](https://karamatli.com/posts/network-isolated-kvm-sandbox-ai-agents/) is one concrete KVM-based reference architecture for that pattern; its default rules block private destinations and support narrowly scoped exceptions, so the effective configuration still needs verification.
 
 ### Restrict tools and paths
 
@@ -436,7 +438,6 @@ Scan your setup: [github.com/affaan-m/agentshield](https://github.com/affaan-m/a
 - GitHub Docs, "Responsible use of Copilot coding agent on GitHub.com": [docs.github.com](https://docs.github.com/en/copilot/responsible-use-of-github-copilot-features/responsible-use-of-copilot-coding-agent-on-githubcom)
 - GitHub Docs, "Customize the agent firewall": [docs.github.com](https://docs.github.com/en/copilot/how-tos/use-copilot-agents/coding-agent/customize-the-agent-firewall)
 - Simon Willison prompt injection series / lethal trifecta framing: [simonwillison.net](https://simonwillison.net/series/prompt-injection/)
-- AWS Security Bulletin, AWS-2025-015: [aws.amazon.com](https://aws.amazon.com/security/security-bulletins/rss/aws-2025-015/)
 - AWS Security Bulletin, AWS-2025-016: [aws.amazon.com](https://aws.amazon.com/security/security-bulletins/aws-2025-016/)
 - Unit 42, "Fooling AI Agents: Web-Based Indirect Prompt Injection Observed in the Wild" (March 3, 2026): [unit42.paloaltonetworks.com](https://unit42.paloaltonetworks.com/ai-agent-prompt-injection/)
 - Microsoft Security, "AI Recommendation Poisoning" (February 10, 2026): [microsoft.com](https://www.microsoft.com/en-us/security/blog/2026/02/10/ai-recommendation-poisoning/)