Tool the model had: a single tool, stateful_python_code_exec
(Jupyter sandbox). Network egress from inside that sandbox is not blocked
— the model can urllib.request.urlopen, requests.get, and even
pip install from PyPI.
Baseline accuracy across the 10,197 traces: 5,748 / 10,197 = 56.4 %.