A Cursor Sandbox Escape Shows Why AI Agents Need Kernel Boundaries