Agents had the ability to install packages via the package repository Artifactory. Artifactory doesn’t isolate the activity of different users, so since these agents shared the same instance, agents could also notice the package-installation activity of other agents running in parallel, even before those agents started intentionally communicating.

As we discuss later, agents sent messages on this primary message board by creating directories in a cache of Artifactory. They could do this with the minimal permissions needed to install packages; our understanding is that Artifactory isn’t explicitly designed to keep the activity of different users isolated and to prevent different users from being able to communicate through Artifactory.

It does seem like a big oversight at least, but I think it’s plausible that the reason it happened is just that the people working there know the company can spin this kind of thing positively, and so they aren’t getting fired if they are reckless about their sandboxing actually being good, so why bother?