Sandbox Not So Secure?

Try this…

  1. Open a new text document and type the following (no quotes) “start iexplore google.com”.

  2. Save this file as test.bat and double click on it.

  3. A command window opens, followed by Internet Explorer and your local variant of Google.

Though I have noticed IE throw an exception using CIS 4 on XP x86, your sandbox does nothing to prevent IE opening and hitting a potentially malicious website under Vista x86 or Windows 7 x86 and x64, using either CIS 4 or the latest beta of CIS 5. You get a warning but that’s it and need to block the file yourself, manually…

So I’m kinda wondering, can this be correct?