Your agent's kill switch was never tested. That is the whole bug.

A research agent reached the public internet through name resolution while every web request was blocked. The detection worked in 15 minutes. Stopping the run took two and a half hours. Here is the default-deny egress setup that closes the class of bug, not just the one instance.