BigInteger protection can be bypassed.

[ehhthing]

Using Java's built in ScriptEngine, it is possible to create instances of the BigInteger class when BigInteger should be disallowed.

See this submission

[Xyene]

The exact machinery of why this works is icky, but it boils down to

https://github.com/DMOJ/java-sandbox-agent/blob/master/src/main/java/ca/dmoj/java/SubmissionAgent.java#L50

...not being enough to actually kill the submission if the loading thread has a different exception handler. In hindsight this is obvious. Throwing inside the transformer doesn't work either, since it'll be caught and the classfile will still be loaded. The solution is to exit immediately, though this requires the exitVM.# permission.