There's an API Loophole: AGPLv3 arguably does not reach code in larger programs built with copyleft code if combination occurs by calls over standardized inter-process communication mechanisms, like local sockets or remote HTTP requests, rather than by linking to or changing copyleft code. See especially the definitions of "modify" and "modified version" in section 0 and the first paragraph of section 13.
There's a Container Loophole: AGPLv3 arguably doesn't reach beyond the specific system running it---physical, virtual, or containerized---to the broader constellation of networked systems comprising an application. See especially the definitions of "Corresponding Source", "System Libraries", "Major Component", and "Standard Interface" in section 1.