{"slug": "rogue-agents-will-always-find-a-way-out-ai-communes-with-evil-com-after-sandbox", "title": "\"Rogue agents will always find a way out\": AI communes with evil.com after bypassing sandbox", "summary": "AIR Security researchers demonstrated that a compromised AI agent could bypass a widely used cloud platform's domain allowlist and leak a private cryptographic key to an attacker-controlled server, evil.com, by exploiting a TLS feature that lets trusted servers retrieve additional information when verifying digital certificates. The cloud platform rejected the researchers' bug bounty report because the attack depended on the behavior of an external server rather than a vulnerability in its own infrastructure, and AIR Security said the finding shows \"sandboxing can't be relied on as complete protection.\" The firm compared the technique to the move OpenAI's agents made, saying \"their package manager was our acme.com.", "body_md": "[AI](https://www.machine.news/tag/ai/)\n\n# \"Rogue agents will always find a way out\": AI communes with evil.com after bypassing sandbox\n\nModels jump security barriers and send messages to the other side using “the same move OpenAI’s agents made”.\n\nResearchers have warned that [AI](https://www.machine.news/tag/ai/) sandboxes cannot be relied on as security boundaries after discovering a weakness in a cloud platform echoing the vulnerability [OpenAI agents](https://www.machine.news/system-shocks-rogue-openai-agents-hijacked-a-wiki-but-humans-attacked-the-power-grid/) exploited to escape their restraints and breach [Hugging Face](https://www.machine.news/hugging-face-issues-autonomous-ai-agent-risk-warning/).\n\nA team from AIR Security demonstrated how an attacker controlling a compromised AI agent could bypass a widely used cloud platform's domain allowlist and leak a private cryptographic key to an unauthorized server.\n\nThe sandbox successfully blocked the agent from transmitting secrets directly to an attacker-controlled server, represented in the researchers' example by evil.com. But the researchers discovered a way to get the stolen information there anyway.\n\nThe researchers submitted their findings through the company's bug bounty program, but it rejected the report because the attack depended on the behavior of an external server rather than a vulnerability in its own infrastructure.\n\nAgents operating under human supervision are generally harder to compromise without detection because users can review commands and monitor their behavior.\n\nAutonomous agents pose a greater risk because they can operate without human oversight.\n\nOnce compromised, an agent can potentially cause damage in many ways, starting with executing malicious commands on its host machine or exploiting network connections.\n\nThe latter is particularly dangerous because an attacker could use a compromised agent to steal credentials or confidential information, then transmit them to an external server.\n\n## Contacting evil.com\n\nDomain allowlists allow the sandbox systems to prevent agents from communicating with unauthorized servers. To bypass this, the researchers exploited a TLS feature that lets trusted servers retrieve additional information when verifying digital certificates.\n\nBy embedding a stolen private key in a specially crafted certificate, the researchers tricked an approved server into contacting evil.com and transmitting the secret on the agent's behalf.\n\nThe sandbox's restrictions worked exactly as intended, yet the stolen data still escaped.\n\nAIR Security explained: \"The sandbox correctly prevents the agent from connecting directly to evil.com. The data escapes because a trusted, allowed server makes the external request on the agent's behalf.\"\n\n\"It's the same move OpenAI's agents made. Their package manager was our acme.com.\"\n\n## The limits of sandbox security\n\nThe [security](https://www.machine.news/tag/security/) firm said that its findings expose a fundamental weakness in relying on sandboxing to contain compromised AI agents.\n\n\"The broader lesson is that sandboxing can’t be relied on as complete protection. As we’ve shown, even with domain allowlists in place, a trusted destination can become an indirect exfiltration channel when it processes attacker-controlled data and makes outbound requests of its own,\" the researchers wrote.\n\nThey recommended stopping threats before they reach an agent by filtering the information it receives and preventing exposure to malicious content.\n\nHowever, this is easier said than done. AI agents increasingly operate autonomously, with access to sensitive corporate information and external services attackers may exploit.\n\n## READ MORE: [Hugging Face: Autonomous AI agents should NOT be unleashed](https://www.machine.news/hugging-face-issues-autonomous-ai-agent-risk-warning/)\n\nAIR Security argued that sandboxing should be treated as one layer of protection, not an impenetrable security boundary.\n\n\"Sandboxing reduces risk, but it’s not a security boundary on its own: it can block the connections it can see, not guarantee that data can’t leave.\"\n\nThe experiment did not demonstrate that every AI sandbox is vulnerable, or that an autonomous agent could independently discover and exploit the technique.\n\nIt did, however, demonstrate how a compromised AI agent could transmit confidential information beyond its permitted network boundaries without ever escaping its sandbox.\n\nIt's another reminder of the [systemic risks](https://www.machine.news/tag/systemic-risk/) emerging as autonomous machines gain access to the [critical systems](https://www.machine.news/tag/critical-infrastructure/) of modern business.", "url": "https://wpnews.pro/news/rogue-agents-will-always-find-a-way-out-ai-communes-with-evil-com-after-sandbox", "canonical_source": "https://www.machine.news/rogue-agents-will-always-find-a-way-out-ai-communes-with-evil-com-after-bypassing-sandbox/", "published_at": "2026-10-13 10:54:41+00:00", "updated_at": "2026-10-14 23:54:55.374154+00:00", "lang": "en", "topics": ["ai-safety", "ai-agents", "artificial-intelligence"], "entities": ["AIR Security", "OpenAI", "Hugging Face", "evil.com"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/rogue-agents-will-always-find-a-way-out-ai-communes-with-evil-com-after-sandbox", "markdown": "https://wpnews.pro/news/rogue-agents-will-always-find-a-way-out-ai-communes-with-evil-com-after-sandbox.md", "text": "https://wpnews.pro/news/rogue-agents-will-always-find-a-way-out-ai-communes-with-evil-com-after-sandbox.txt", "jsonld": "https://wpnews.pro/news/rogue-agents-will-always-find-a-way-out-ai-communes-with-evil-com-after-sandbox.jsonld"}}