What should teams do first after a formula sandbox escape is disclosed?

Prioritise containment before broadening use. Patch or disable the vulnerable execution path, revoke exposed credentials, confirm which deployments are affected, and remove any secrets or integrations the runtime should not have been able to touch. Then reassess who is allowed to author formulas and how much trust the workflow tool is given.