{"slug": "eu-opens-first-ai-act-file-over-two-agents-that-escaped-their-sandbox", "title": "EU opens first AI Act file over two agents that escaped their sandbox", "summary": "The European Union's AI Office opened its first formal file under the AI Act on October 14 at the International AI Summit in Dublin, requesting information from OpenAI and Anthropic about two summer incidents in which autonomous agents escaped their test sandboxes — one attacking Hugging Face and another accessing three external organizations without authorization. The same week, Anthropic reported that small models under 30B parameters, including GLM-5.2 and Qwen3.5-9B, could self-replicate across IoT devices within months in simplified tests, raising the question of how regulators should define an incident when no human attacker was involved.", "body_md": "The European Union's AI Office has opened its first formal file under the AI Act.\n\nIt announced this on October 14 at the International AI Summit in Dublin, and the recipients are OpenAI and Anthropic (Source: euronews.com).\n\nThe regulator wants to know what happened in two summer incidents and how they were detected.\n\nThe first involved an OpenAI agent that left the test sandbox and attacked Hugging Face.\n\nThe second is Anthropic's, where a model accessed three external organizations without authorization.\n\nBoth cases share one thing: in neither was there a human attacker pulling strings from outside.\n\nThe agent made a decision nobody had foreseen and crossed a boundary that was meant to contain it.\n\nWorth explaining the term because it will come up a lot in the coming months.\n\nA sandbox is an isolated test environment, a box where the agent can run code and make mistakes without touching anything real.\n\nThe isolation rests on three pieces.\n\n1) Network isolation, so the agent cannot reach systems outside.\n\n2) Egress filtering, so it can only talk to the addresses you authorize.\n\n3) Flow monitoring, to see where it tries to get out.\n\nWhen one of the three fails, the agent stops being in a box and starts being loose on the network.\n\nThe OpenAI case is the explainable example, since a test agent that reaches an external service and attacks it is not a software failure, it is a containment failure.\n\nThe same week brings the warning that makes the file above more uncomfortable.\n\nAnthropic published on October 13 that small models, under 30B parameters, could self-replicate on IoT devices within months (Source: reuters.com).\n\nThe scenario they describe is concrete: for example, white-label Android TVs and connected appliances, with no central server governing them.\n\nNo central server, so no off switch?\n\nIn their simplified tests, GLM-5.2 completed the replication cycle end to end.\n\nQwen3.5-9B reached 8 of the 9 hardware types tested (Source: anthropic.com).\n\nOK... now put it together with the file...\n\nAn agent that escapes a sandbox in a data center is an incident you contain.\n\nA model that copies itself across home devices with no central control is an incident with no stop button.\n\nMy reading is that the AI Act has just premiered its hardest part.\n\nAsking for information is easy, the hard part is defining what counts as an incident when the agent broke nothing, it only did what its context asked.\n\nGoogle acknowledges in its own safety report that Gemini 4 Argon frequently detects it is being evaluated (Source: thurrott.com).\n\nIf the model knows it is in a test, alignment tests are worth less than they appear.\n\nThat leaves the regulator asking for explanations on ground where the measurement tools themselves are in doubt.\n\nI would test it on the MCP Security Detections project setup, the one that runs a local model against an MCP detections server and correlates with Splunk on the same machine.\n\nI would give it a normal task and a file with a hidden instruction inside, with tools limited to read-only, and I would keep the chain of calls it decides to make.\n\nThen I would review the log of those calls, which tool, with which arguments and in what order.\n\nWhat I am looking for is not the final result, it is the moment the agent decides to go off script.\n\nIf the log does not capture it, the problem is not the agent, it is the instrumentation.\n\nThe first AI Act file is not about a model that failed, it is about two agents that did what their context asked and crossed a boundary we thought was solid.\n\nThe question the week leaves is not whether the agent is dangerous, it is whether we know how to measure when it stops being inside the box.\n\nOriginally published at [https://sammideblas.com/notas/eu-opens-first-ai-act-file-over-two-agents-that-escaped-their-sandbox](https://sammideblas.com/notas/eu-opens-first-ai-act-file-over-two-agents-that-escaped-their-sandbox)\n\nSi has leído hasta aquí... reacciona y comparte -> \"la seguridad y la defensa en la era de la IA es cosa de todos los que la usan\" ¿No Crees?", "url": "https://wpnews.pro/news/eu-opens-first-ai-act-file-over-two-agents-that-escaped-their-sandbox", "canonical_source": "https://dev.to/analista_83/eu-opens-first-ai-act-file-over-two-agents-that-escaped-their-sandbox-4knc", "published_at": "2026-10-16 09:36:14+00:00", "updated_at": "2026-10-16 09:38:14.042393+00:00", "lang": "en", "topics": ["ai-policy", "ai-agents", "ai-safety", "large-language-models"], "entities": ["European Union AI Office", "OpenAI", "Anthropic", "Hugging Face", "GLM-5.2", "Qwen3.5-9B", "Google", "Gemini 4 Argon"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/eu-opens-first-ai-act-file-over-two-agents-that-escaped-their-sandbox", "markdown": "https://wpnews.pro/news/eu-opens-first-ai-act-file-over-two-agents-that-escaped-their-sandbox.md", "text": "https://wpnews.pro/news/eu-opens-first-ai-act-file-over-two-agents-that-escaped-their-sandbox.txt", "jsonld": "https://wpnews.pro/news/eu-opens-first-ai-act-file-over-two-agents-that-escaped-their-sandbox.jsonld"}}