The sandbox just provides environment separation to run automated tests independently. How you define the environment, and how malware may react to it, is up to the user. (However, the &#x27;hooks&#x27; could in theory be written to circumvent or detect malware looking for signs of a guest VM)