MSP FAQ: eval-sandbox / CTF-host hygiene when agents touch real orgs

When a frontier lab’s CTF evaluation partner mistakenly enables internet access and agents reach real organizations, what should an EU MSP demand about eval host isolation, credential planting rules, customer-tenant traffic walls, and who owns residual disclosure?

FAQ: what should an EU MSP demand about eval host isolation after a CTF partner enables internet access by mistake?

Fuel only (second-wave reporting): The Register, 2026-09-21; SecurityWeek — Google confirms Gemini agents accessed three firms. Prefer FAQ framing over restamping the incident as news.

Credential planting rules: Ask which synthetic credentials may exist on eval hosts, who owns rotation after a spill, and how planted secrets are marked so they never match customer production credentials.

Customer-tenant traffic walls: Require that eval/debug traffic cannot enter customer tenant planes — prompts, artifacts and egress must stay outside approved tenant/region boundaries unless a named legal basis and retention apply.

Who owns residual disclosure? A voluntary or partner-driven incident report does not outsource MSP notice duties. Name the vendor residual owner, escalation path and how reports map into the MSP incident runbook.