the triage agent hung when the sandbox console froze mid-detonation and returned an error

TL;DR

A frozen console gives no error to handle: the session simply stops answering, and an agent without supervision waits forever. Add the supervision the console lacks: heartbeat checks on the session, a hard inactivity limit after which the worker is declared dead, safe restart that requeues the in-flight sample, and a cap on restarts so a poison sample that freezes every console is quarantined for manual handling instead of looping the fleet.

the triage agent hung when the sandbox console froze mid-detonation and returned an error

Use this when

• The agent shows a detonation in progress for far longer than any normal analysis.
• The sandbox console session is visibly frozen or unresponsive.

Not for this skill when

• The sample is genuinely long-running within platform limits. Check platform timing before restarting workers.
• The whole sandbox platform is down. Console restarts will not help; use the outage path.

Steps

1. Confirm the freeze: check the console session responsiveness and the sample elapsed time against normal detonation durations. Verify: freeze versus slow is decided with timings.
2. Terminate the stuck worker and requeue its sample once, recording the freeze against that sample hash. Verify: the worker restarts clean and the sample is tracked.
3. Add inactivity supervision: if a console session shows no progress event within the limit, the supervisor restarts it automatically. Verify: a simulated freeze is recovered without human action.
4. Set a per-sample freeze limit: after repeated freezes, route the sample to manual analysis and flag it as a possible sandbox-evasion attempt. Verify: the poison sample path exists.
5. Run the agent through a normal campaign batch. Verify: detonations complete, and any freeze is recovered and logged.

Variant phrasings

sandbox console frozen mid detonation agent hang

The frozen console variant.

detonation worker supervision restart poison sample

The supervision variant.

Compatibility: Self-managed and vendor sandbox consoles with agent browser or API supervision.

Why it happens

Consoles are built for a human who notices a frozen screen. An agent sees only the absence of the next event, and without an explicit inactivity model, absence has no deadline, so the hang lasts until a human notices the queue.

Edge cases / pitfalls

• Freeze patterns are intelligence: samples engineered to crash analysis are telling you something about the campaign.
• Restart storms can cascade across a worker fleet sharing one bad sample. The per-sample cap prevents it.
• Keep console screenshots at freeze time; they often show the evasion behaviour mid-act.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstRLP2ia9r6iLyQicZxgKGA