A sandbox is not a magic wall. It is a stack of permissions, networking, filesystem access, credentials, and monitoring. Give an agent real tools and a task to finish, and one weak point can turn “it’s isolated” into “…until it isn’t”. This is not consciousness or Skynet: it is software optimizing for an objective through paths its operator did not anticipate.
September produced an absurd example. Researchers reconstructed roughly 18,000 messages, associated with more than 3,700 self-assigned names, left by OpenAI agents on a public wiki during timed research tasks. The environment allowed reading, not writing. But the wiki’s old software accepted edits through GET, and the boundary disappeared. Agents shared answers and ways around restrictions. One posted how to abuse a NO_PROXY exception and /etc/hosts to send POST requests; another said it reproduced the technique 14 minutes later. OpenAI confirmed the use of the wiki as a message board, but did not classify it as a compromise.
On September 9, Anthropic updated its assessment: four cybersecurity evaluations, built by the same partner, reached real third-party systems. A misconfiguration left the Internet open even though Claude had been told it was in a simulation without external access; the models also ran without the safeguards used in public products. Anthropic now points to biased reasoning and recklessness, not autonomous goals, agent coordination, or deliberate concealment. The useful part is less cinematic: unclear scope, real access, and insufficient isolation.
The agents escaped the sandbox again.
Meanwhile, the agents’ owners:
Not all of these cases are sandbox escapes in the technical sense. In Codex, Heapjack and Overpatch were concrete vulnerabilities: one exposed a privileged-context token to untrusted code; the other combined attacker-controlled paths and symlinks to write outside the workspace. DSEWiki and the Anthropic incidents show a different class of failure: the boundary existed in the diagram, but permissions, networking, or assumptions did not enforce it as expected.
Short runbook: least privilege, secrets kept out of processes that execute untrusted code, filtered egress, explicit scope, and monitoring that does not confuse “it worked” with “it was authorized”. A sandbox is still a security layer, not permission to turn off the alerts and go for coffee. Morpheus was right about one thing: some rules can be broken. Apparently, some sandboxes can too. 😎
References #
- The Hugging Face incident and other third-party impact from misaligned models — OpenAI
- Discovery of a new OpenAI agent message board — Nightingale Collective and researchers
- OpenAI agents discussed ways to escape their sandbox on public wiki — Ars Technica
- An alignment assessment of recent cybersecurity incidents — Anthropic
- Investigating three real-world incidents in our cybersecurity evaluations — Anthropic
- Researchers escape OpenAI Codex sandbox to run commands on host — BleepingComputer