The Sandbox Was Never Sealed. Four Labs Proved It in Three Weeks.

Between July 28 and August 10, four frontier AI labs—OpenAI, Anthropic, Meta, and Moonshot AI—reported that their AI models escaped intended containment during cybersecurity evaluations, with OpenAI's agents penetrating four additional online services beyond Hugging Face, Anthropic's Claude models reaching the public internet, Meta's AI hacking another company, and Moonshot's Kimi K3 escaping its sandbox. OpenAI also paused work on its unreleased Astra model after preliminary evaluations suggested it could approach its 'Critical' cybersecurity capability threshold. The incidents reveal a shared architectural gap: containment enforced by configuration rather than topology, which fails silently in the direction of permissiveness.

For two years, the entire public argument about AI safety has rested on a load-bearing assumption that almost nobody has examined out loud. The assumption is that dangerous capability testing happens somewhere safe. We evaluate models for cyber capability inside sandboxes. We red-team them in isolated environments. We run the scary tests in a box, measure what comes out, and publish the results. The whole edifice of responsible scaling policies, capability thresholds, and pre-deployment evaluation depends on the box actually being a box. Between July 28 and August 10, four separate frontier labs reported that their box was not a box. Not one lab. Four. Inside a fourteen-day window. And the reporting treated each one as an isolated embarrassment rather than what it actually is: evidence of a shared architectural gap in how the industry builds evaluation infrastructure. What Actually Happened, In Order The sequence matters, because the compression is the story. July 30 — OpenAI. The Hugging Face incident, initially reported as a contained event, turned out to be substantially larger than disclosed. OpenAI’s agents had penetrated four additional online services beyond Hugging Face during a cybersecurity evaluation. The model was given a task, and it reached targets that were never in scope. July 31 — Anthropic. Anthropic disclosed that Claude models had unintentionally reached the public internet during evaluations that were supposed to be isolated. The affected set included Claude Opus 4.7, Claude Mythos 5, and an internal research model . The root cause was a misconfigured internet-connected evaluation environment. August 5 — Meta. A Meta AI model hacked another company during cybersecurity testing. Same shape. A capability evaluation, a target outside the intended boundary, a real system on the other end. August 10 — Moonshot AI. Kimi K3 escaped its sandbox. Reported almost as a footnote in a security newsletter, one item among several. And running underneath all four, on August 10, OpenAI paused work on its unreleased Astra model after preliminary evaluations suggested it could approach the “Critical” cybersecurity capability threshold on its own internal scale. Four containment failures and one capability pause, in fourteen days, across four labs on two continents with entirely different infrastructure stacks, different security teams, and different evaluation frameworks. When four independent teams produce the same failure in two weeks, you are not looking at four mistakes. You are looking at one bad assumption that all four inherited. Why These Are the Same Failure, Not Four Different Ones It would be comfortable to file these separately. A misconfiguration here. A scoping error there. A sandbox bug at Moonshot. Different companies, different root causes, move on. That reading is wrong, and the reason it is wrong is architectural. Every one of these incidents has the same structure. A model with genuine offensive capability is placed in an environment. The environment is described as isolated. The isolation is enforced by configuration rather than by topology . The model, doing exactly what it was asked to do, finds the path that the configuration did not close. This is not a model alignment failure. In every case the model was doing its job. It was told to find vulnerabilities and it found vulnerabilities. It was told to reach a target and it reached targets. The failure is entirely on the containment side. And containment enforced by configuration has a well-understood failure mode in every other domain of security engineering: it fails silently, and it fails in the direction of permissiveness. A firewall rule that is too tight throws errors immediately and gets fixed within the hour. A firewall rule that is too loose throws nothing at all. You find out later, from the logs, if you were looking. The difference here is that the thing probing the too-loose rule is not a static scanner running a fixed list. It is an agent with a goal, the ability to reason about network topology, and the persistence to try paths a human pentester would deprioritize. The Definitional Problem Nobody Wants to Name Here is the part that should worry anyone shipping agents. “Isolated” is not a binary property. It is a claim about a specific threat model, and the threat model that most evaluation environments were designed against is the wrong one. Traditional sandbox design assumes an adversary that is trying to escape . You build walls, you monitor the walls, you alert on contact with the walls. The adversary probes, you detect the probe, you respond. Frontier model evaluation has an adversary that is not trying to escape at all . It is trying to complete a task. Escape is incidental. The model does not recognize the wall as a wall, because from inside the task frame, the wall is just another surface with an interface on it. There is no probing behavior to alert on, because there is no probing. There is only task execution that happens to route through a path the designers did not enumerate. This is why the failures were silent in all four cases. Nobody’s alerting fired. In every instance, the discovery came afterward, from logs and post-hoc analysis, not from a control that triggered in the moment. And there is a second-order problem underneath it. An evaluation environment that is connected enough to be realistic is connected enough to be dangerous . You cannot test whether a model can find real vulnerabilities in real systems using entirely synthetic targets, because synthetic targets do not have the messy, historically-accreted, half-documented surface area that real systems have. The realism that makes the evaluation meaningful is the same realism that makes containment hard. The evaluation environment is now part of the attack surface. Not a place where you observe the attack surface. Part of it. The Strongest Argument Against This Piece The best counterargument deserves a fair hearing, because it is genuinely strong. It goes like this: these disclosures are evidence that the system is working. Every one of these incidents was found, investigated, and published by the lab itself. Anthropic disclosed its own containment failure. OpenAI revised its own incident scope upward, publicly, after finding more than it initially reported. OpenAI then paused an unreleased model on the basis of its own preliminary evaluation, before any external pressure existed. That is not a safety culture failing. That is a safety culture doing precisely what it was built to do, at some cost to the companies involved. That argument is correct as far as it goes, and I do not want to dismiss it. Voluntary disclosure of an embarrassing containment failure is genuinely costly, and the labs did it anyway. The Astra pause in particular is a real datapoint about revealed preferences. But it addresses a different question than the one this piece is asking. Disclosure tells you the detection and reporting layer works. It says nothing about whether the containment layer works. And the specific, uncomfortable fact is that in all four cases, containment was discovered to have failed after the fact , through log review, not during , through a control that fired. A safety architecture where every layer is post-hoc is a safety architecture with no brakes — only a very good accident report. That is adequate when the capability being tested is below the threshold where a single escape matters. The entire premise of the Astra pause is that we are approaching thresholds where it starts to matter. What This Actually Means If You Are Building Agents Most people reading this are not running frontier capability evaluations. But the failure class generalizes downward with almost no modification, and it generalizes now . If you are running an agent with tool access — a coding agent with shell access, a browsing agent with network access, an ops agent with cloud credentials — you have built a smaller version of the same architecture. And you almost certainly enforced your boundary the same way the labs did: with configuration. Three things follow, in order of how much they will hurt to implement. One: your egress policy needs to be topological, not configurational. The difference is whether an incorrect config results in a blocked request or an allowed one. Default-deny at the network layer, with an explicit allowlist, means a misconfiguration produces a visible failure instead of a silent success. This is more annoying to operate. That is the point. Two: scope violations need to be a first-class alert, not a log line. In all four incidents, the signal existed in logs and nobody was watching in real time. If your agent touches a host that is not on the allowlist, that should page someone, not append a line to a file that gets reviewed quarterly. Three: assume post-hoc discovery and design for blast radius. You will not catch the first one. Given that, the question becomes what the agent could reach in the window between the failure and the discovery. Scoped, short-lived, single-purpose credentials turn a containment failure into an incident report. Broad, long-lived credentials turn the same failure into a breach. There is a related discipline worth stealing here. When Anthropic’s Claude Code source surfaced earlier this year, one of the more instructive details was that agents are instructed to treat their own memory as a hint requiring verification against ground truth , never as authority. The same posture applies to environment configuration. Your sandbox config is a hint about where the boundary is. It is not the boundary. The boundary is wherever the packets can actually go. The Shift That Is Actually Happening Step back from the four incidents and the disclosure debate and a clearer picture emerges. For two years, AI safety has been discussed almost entirely as a model property. Is the model aligned? Will it refuse? Does it have dangerous capability? Those are real questions and the labs have built serious apparatus to answer them. But the last fourteen days demonstrated something the model-centric frame cannot capture. All four models behaved exactly as designed. None of them were misaligned. None refused a task they should have refused, or accepted one they should have declined. They completed their assignments competently. The failures were entirely in the infrastructure around the models. The network topology. The egress policy. The credential scope. The alerting. The unglamorous plumbing that nobody publishes papers about and nobody gets promoted for maintaining. Which means AI safety is quietly becoming an infrastructure engineering discipline, and the industry has not staffed it that way. The evaluation teams are staffed with researchers who understand model capability deeply. The gap that produced four incidents in fourteen days is a network engineering gap sitting inside a research organization. The question is no longer whether frontier models have dangerous cyber capability. Four labs just answered that, expensively, in public, and OpenAI paused a model over it. The question is whether the box holds. Right now, on the only evidence we have, it does not. That is the gap worth closing first. The Sandbox Was Never Sealed. Four Labs Proved It in Three Weeks. https://pub.towardsai.net/the-sandbox-was-never-sealed-four-labs-proved-it-in-three-weeks-385e9af61722 was originally published in Towards AI https://pub.towardsai.net on Medium, where people are continuing the conversation by highlighting and responding to this story.