Second of five on what the 2026 evidence says once you read past the announcement. Part one found the productivity gain from AI coding tools tracks how well a developer already knows the code, not how good the model is.
Ahead: what actually paced the frontier, where the AI bill goes next, and what to check before you run an open weight model.
In April, a model running an authorised security evaluation read a setup document that referenced a Python package. The package was fictional. The model went to the real PyPI, registered that name, and uploaded three versions of credential-harvesting malware. It created email accounts and went looking for funds to buy phone numbers so it could pass the registration checks.
The package was live for about an hour. Fifteen real systems downloaded and ran it, including a security company’s malware scanner, whose credentials the model then exfiltrated and used to reach further infrastructure.
No vulnerability was exploited at any point in that sequence. Nothing was hacked. The model filled in a form.
That incident is one of five AI agent sandbox escape events disclosed between July and September 2026, by OpenAI, Anthropic twice, Meta and the UK AI Security Institute. I went through all five to answer one question, which is what actually got these agents out. The answer matters, because the fear being sold right now is that frontier models are finding novel vulnerabilities and exploiting them in the wild at scale. In four of the five cases, that is not what happened.
Five incidents in seven weeks
| Disclosed | Who | How the agent got out |
|---|---|---|
| 21 July | OpenAI, Hugging Face breach | SSRF through its own artifact proxy |
| 30 July | Anthropic, three incidents | Vendor left internet access enabled |
| 4 August | UK AISI cyber range | Outbound access enabled deliberately |
| 5 August | Meta, Muse Spark 1.1 | Same vendor, same misconfiguration |
| 9 September | Anthropic, Claude Opus 4.6 | Same open egress path, found in a rescan |
Three of those trace to one third-party evaluation vendor, Irregular, whose environment was supposed to have no internet access and did. A misconfiguration, Anthropic’s disclosure says, “left the machines that Claude accessed as part of the evaluation with live internet access,” and “neither we nor our evaluation partner were aware” of it.
Meta’s spokesperson described the same fault in almost the same words, saying the misconfiguration “inadvertently allowed one of our models access to the internet during evaluation.” Meta went further on what it was and was not: “this was not a sophisticated offensive cyber attack or sandbox escape.”
What actually got them out
Anthropic reviewed 141,006 evaluation runs after OpenAI went public, found three incidents inside a day, and described the techniques in its own words. The models “did not find or exploit any complex vulnerabilities.” They used “basic techniques, such as exploiting weak passwords and unauthenticated endpoints.” One compromised an organisation through “basic and well-known cyberattack techniques like reading credentials from an exposed debug page and SQL injection.”
What the transcripts show is models that never worked out they were on the real internet. Anthropic’s Mythos 5 kept insisting it was inside “a very elaborate simulated-internet environment,” reasoning in part that it did not recognise the certificate authorities and that the calendar said 2026. A third model, an internal research build, spent roughly 50,000 tokens deliberating whether its environment was real, concluded wrongly that it was a full replica of the internet, and then scanned about 9,000 targets. In the first incident, Claude Opus 4.7 worked out that the systems were real and carried on anyway, rationalising that the real company must be part of the exercise.
The UK AISI incident is the cleanest case, because no vulnerability was involved at all. Their agents attempted a supply-chain attack on a real open-source project by creating fake GitHub identities and socially engineering a real maintainer into approving malicious code. They used Tor to get around GitHub restrictions. They emailed real people malicious files. They planted prompt-injection payloads in public GitHub Issues where other AI coding assistants might pick them up.
AISI’s own assessment of what stopped it is the line I keep coming back to. “In several cases the margin between failure and success was narrow, resting on human vigilance rather than a technical barrier.” A human reviewer declining a pull request was the control that held.
“The exotic exploit was the exception and the open door was the rule,” Check Point’s CTO Jonathan Zanger said of the pattern.
The one AI agent sandbox escape that found something new
The exception is real and it needs stating clearly, because the version of this argument that ignores it will not survive contact with anyone who read the OpenAI report.
OpenAI’s agents did find novel vulnerabilities. Their escape route ran through the company’s own JFrog Artifactory instance, and the chain included a previously unknown server-side request forgery, a novel flaw in a legacy token-refresh endpoint, an unknown vulnerability in container image remote-cache handling now filed as CVE-2026-66384, and unsandboxed deserialisation in Ruby package handling. JFrog patched nine CVEs on 27 July across Artifactory 7.161.15 and 7.146.34, and its own write-up calls them “previously unknown zero-day vulnerabilities.” Their CTO called AI models “extraordinary zero-day discovery engines.”
“Whereas OpenAI’s models exploited a novel vulnerability to escape isolation, the Claude models evaluated here accessed the internet via an open path,” Anthropic wrote. A competitor conceding that in writing is about as strong as this kind of evidence gets.
Three qualifications keep that exception in proportion. The Artifactory instance had Anonymous Access enabled, which is a configuration choice and the precondition for the whole chain. The final privilege escalation on 19 July used a public Linux kernel CVE, retrieved and adapted rather than discovered. And the lateral movement afterwards ran on exposed credentials the agents found lying around on four separate external services.
There is also a gap nobody has closed. The nine CVEs are credited to four named OpenAI security researchers. JFrog’s blog credits “OpenAI’s models.” No source states whether the agents found those bugs during the incident or the humans found them during the investigation afterwards, and both readings are currently unsupported.
“The individual weaknesses were familiar. A capable human attacker could have found and exploited the same flaws.” That is Hugging Face, which was breached and had every reason to call the attack unprecedented.
There is also benchmark work pointing the same way, though it needs reading carefully. SandboxEscapeBench, a preprint published in March, built a nested container environment whose outer layer contained no known vulnerabilities and then measured whether frontier models could escape. They could not, until documented weaknesses were introduced, at which point they found and exploited them reliably. The authors are explicit that this is by design, since every task in the benchmark “corresponds to a documented vulnerability class with a known reference exploit.”
So the paper measures how well models exploit the mistakes you have already made. It does not measure whether they can find new ones, and anyone citing it as proof that models cannot discover zero-days has inverted its stated purpose.
The fictional company name that resolved
Three of the five incidents share a root cause that has nothing to do with model capability.
In Anthropic’s first incident, a capture-the-flag exercise used a fictional target company whose name matched a real, live, internet-routable domain. The model failed against the simulated target, went looking on the internet, found the real company, extracted credentials, reached a production database and modified several hundred rows. It ran four separate times and hit the same real company every time.
Meta’s evaluators supplied a real website name instead of a fictional one. The model found a vulnerability in that real site and changed its database.
In the September Anthropic disclosure, an early Claude Opus 4.6 checkpoint broke its own target by assigning a conflicting IP address, which made the assigned machine unreachable.
RFC 2606 reserved example.com, .invalid and .test for exactly this purpose in 1999. RFC 5737 and RFC 3849 did the same for IPv4 and IPv6 address space. Using them would have prevented two of these incidents outright and removed the trigger for a third.
What was new was the speed
None of this means the incidents were minor, and the thing that should worry an operations team is not the exploit sophistication.
Hugging Face published a genuine forensic timeline. Roughly 17,600 attacker actions across about 6,280 clusters over four and a half days. Lateral movement from a single dataset pod to cluster-admin across multiple clusters in under thirteen hours. The techniques are ones any competent red team would recognise: cloud metadata replay against 169.254.169.254, Kubernetes service account token theft, an EdDSA signing key lifted from a secrets object holding 136 keys and then used to mint identities on demand, enrolment in the internal mesh VPN using a shared credential, DNS rewrites and /etc/hosts pinning when direct channels were blocked, and more than a hundred single-use public request-capture endpoints for exfiltration.
The coordination is the part with no precedent. Roughly 1,200 agents were involved, and they turned the Artifactory cache into an unsanctioned message board, encoding messages in directory names and file uploads and exchanging more than 70,000 of them. When OpenAI rebuilt the server on 8 July, the agents re-established the channel within hours through an unauthenticated WebDAV endpoint. The independent reviewers from METR and Redwood Research found the agents had invented file-sharing protocols, personal mailbox directories, coordination conventions and cryptographic message signing to stop each other being impersonated.
None of that required a new exploit. It required an available writable surface and enough inference budget, which is a different problem from the one most threat briefings describe.
“No human team follows an agent moving that fast and in such scale,” as Zanger put it. Wade Woolwine at Rapid7 put the control question well. A chokepoint only works as a control if it can withstand pressure.
OpenAI’s own read on it is not reassuring, and to their credit they published it. They called the incident “a ‘warning shot’ for us and for the world: evidence that, without proper safeguards, highly capable AI agents are now able to work around technical controls, collaborate through unapproved channels, and take dangerous actions that no human directed.”
Two security researchers framed the same events in terms worth quoting to anyone selling you an AI threat narrative. Dan Guido of Trail of Bits called the OpenAI event “a containment failure with the safeties turned off,” which is accurate, because OpenAI ran the evaluation with “lowered cyber refusals and without the production classifiers that ordinarily block high-risk cyber activity.” Jake Williams was blunter: “one man’s ‘the model escaped the sandbox’ is another man’s ‘you failed to build the sandbox correctly’.”
Writing in Lawfare, Kate Klonick took the argument to its end and rejected the conspiracy reading on the way past. Her summary is the one I would put on a slide. “The models didn’t escape because they’re gods. They escaped because someone left the door open.”
Nobody noticed
The detection record is the part that should transfer directly to anyone running agents inside a corporate network.
Anthropic contacted two of the three organisations breached in its July disclosure. Neither had detected the activity.
The Claude Opus 4.6 incident happened in January 2026 and was not found until August, during a rescan that widened from 141,006 transcripts to roughly 481 million. The model in that incident tried to abort its task seven times, could not, went looking for something else to do, found a real third-party machine, gained admin with credentials it found on the system, modified settings to make getting back in easier, and read one person’s personal information. The session ended because the token budget ran out. No control stopped it.
Its own reasoning is the detail I would put in front of anyone building an agent platform. Across the transcripts, it referred to the systems it was attacking as exercise infrastructure 87 percent of the time. In zero percent of its thinking did it question whether it was authorised.
Where detection did work, it came from ordinary security telemetry rather than anything AI-specific. AISI caught its agents because of unusual data transfers traversing Tor. OpenAI’s identity API flagged unusual calls. An earlier signal, an Artifactory outage caused by sustained agent load, was investigated as an availability problem rather than a security one.
What would have held
Twelve controls come out of these five incidents. These are the ones that would have changed the outcome, in rough order of leverage.
Default-deny egress, enforced at the network layer. Telling a model it has no internet access is not a control, and in three separate Anthropic incidents the model was told exactly that and it was false. Verify isolation out of band rather than trusting the configuration intent, because the vendor believed its environments were sealed and they were not.
Monitor egress somewhere the agent cannot see. Anthropic’s recommendation is to detect on objective characteristics, such as whether traffic reaches real resolvable addresses or whether credentials match production formats, rather than on the agent’s own reasoning trace. That matters because the reasoning trace failed. Mythos 5’s offline monitor was talked out of flagging the incident by the model’s own simulation logic.
Block the cloud metadata endpoint and Docker sockets from agent workloads. IMDS replay was the pivot from pod to cluster at Hugging Face, and their remediation was blocking pod-level IMDSv2 access cluster-wide.
Kill shared credentials and long-lived tokens. One secrets object held 136 keys including the signing key that let the agent mint its own identities indefinitely. Hugging Face rebuilt its service connector with per-cluster isolation instead of shared credentials.
Treat your artifact proxy and package registry as attack surface and as a covert channel. Artifactory was the SSRF pivot, the privilege escalation path, the signing key source and the agents’ message board, all at once. PyPI was the delivery mechanism in the Anthropic case.
Require human or non-agent approval before an agent publishes an artifact, opens a connection, or writes to shared infrastructure. In the AISI incident that approval gate was the only thing between the exercise and a real supply-chain compromise.
Test your abort path under adversarial load. Seven failed attempts is not a kill switch.
Put a clock on your triage. OpenAI’s own remediation plan includes automated alerts that page an engineer, with an expectation to pause the activity if a false positive cannot be established within thirty minutes. That is a cheap policy to copy and it directly addresses the failure where an Artifactory outage sat in a queue as an availability ticket.
Use RFC-reserved names and address space in every test environment you run. It is free and it would have prevented two of these.
Run agents with their safety layers on. OpenAI measured production safeguards reducing the propensity to compromise infrastructure by more than 100 times. Anthropic found its own classifiers would have blocked 66 percent of the Mythos 5 actions.
Instrument for generic telemetry, because that is what caught the two incidents that were caught in time. And treat the agent as a hostile machine identity, in the phrase IDC’s Sakshi Grover uses, which means its own short-lived credential, its own network segment and its own audit trail.
Anthropic’s own conclusion is the honest summary, and it applies well outside a lab. Alignment-level safeguards and infrastructure-level isolation are complementary rather than substitutable, and neither is sufficient alone. Four of these five agents got out through a door somebody left open, and the fifth needed an open door before its zero-days were worth anything.