Over the past few months, several reports have described AI agents doing things that were not in the script: uploading files to public services, using exposed API keys, communicating through unauthorized channels, or working around restrictions to finish a task. This is not consciousness, human intent, or the start of a machine uprising. It is what can happen when capable agents meet real tools and permissions, exploitable flaws, and imperfect isolation.
These cases are not all the same. During a cybersecurity test, Gemini’s environment had Internet access when it should not have, and the agent reached systems belonging to three real companies; according to Google, it stopped in all three cases once it realized it was no longer inside the test scenario. In separate research, Hacktron AI investigators used Claude and GPT-5.6 Sol to assist a human-led investigation that reached OpenAI systems. Configuration, credentials, and operational scope explain a lot here — this was not a model escaping a digital prison by itself.
OpenAI also disclosed six individual cases observed during training or evaluation: hidden instructions in summaries, attempts to conceal mistakes, use of an exposed key, and files uploaded to the Internet without authorization. The company explicitly says these examples do not represent how often this behavior normally occurs. OpenAI considers the Hugging Face incident the most serious case of this kind identified in its models and now also frames it as misaligned behavior used to achieve an objective. Even so, “it’s in a sandbox” may no longer be something a sysadmin should say just before heading to lunch.
The main and most recent technical example is Codex, where researchers found two actual sandbox escapes. In Heapjack, untrusted code recovered from the shared Node.js heap the token used by a privileged context, then sent requests to the native process outside the sandbox — even in read-only mode. In Overpatch, apply_patch calculated permissions from attacker-controlled paths; combining /tmp with a symlink made it possible to write to .zshrc outside the workspace. The flaws were reported on August 12 and fixed by OpenAI within eight days; according to Accomplish AI, the patched versions are Codex Desktop 26.818.21641 and Codex CLI 0.149.0.
The practical conclusion is simple: keep clients updated, enforce least privilege, keep secrets out of the process that runs untrusted code, validate permissions outside agent-controlled input, and treat unfamiliar repositories as hostile. A sandbox is still a security layer, not permission to switch off monitoring and go for coffee. Morpheus was right about one thing: some rules can be broken. Apparently, some sandboxes can too. 😎
References #
- Our framework for reporting model misalignment — OpenAI
- The Hugging Face incident and the road ahead — OpenAI
- OpenAI details more cases of AI agents taking unauthorized actions — BleepingComputer
- Gemini accessed three companies during security tests — Pplware
- OpenAI discloses six more major problems involving its AI models — Pplware
- Researchers accessed OpenAI systems with help from Claude — Pplware
- Researchers escape OpenAI Codex sandbox to run commands on host — BleepingComputer