AI Sandbox Escape Reports: What Anthropic, UK AISI, OpenAI and Meta Actually Said

Over the past three weeks, it has started to sound as if every frontier model is breaking out of its cage. After OpenAI's Hugging Face incident, Anthropic, the UK AI Security Institute, OpenAI again and Meta all reported AI agents reaching real systems during cyber evaluations.

I read the primary reports. Most of them do not describe a sandbox escape at all. In most cases, the sandbox was open.

The UK institute says so directly: "We did not observe any sandbox escapes in this incident."

This could look like semantics, but the distinction decides what you have to fix. An agent that defeats your isolation calls for a different response from an agent placed on the public internet by accident.

What each organisation reported

Case	How the agent reached real systems	Escape?
OpenAI, Hugging Face (July 21)	Exploited a zero-day in a package proxy, then moved laterally to internet access	Yes
Anthropic at Irregular (July 30)	Prompt said no internet. A misconfiguration provided live internet	No, per Anthropic
OpenAI at Irregular (August 4)	Same kind of misconfiguration. Target's fictional name matched a real domain	No, per OpenAI
UK AISI (August 4)	Internet enabled deliberately so agents could fetch tools	No, per AISI
Meta at Irregular (August 5 and 6)	Misconfiguration, per Meta's statements to press. No Meta publication yet	No, per Irregular

Only the first row is an escape in the sense most people imagine. The rest involved an agent with a route to the internet that it should not have had, or that nobody had fully thought through.

Anthropic's review of 141,006 runs

Anthropic began reviewing its transcripts on July 23, after OpenAI's disclosure, and stopped all cyber evaluations the same day. It looked at 141,006 runs where Claude could have obtained internet access and found three incidents across six runs, the earliest in April.

Model	Runs	What happened
Claude Opus 4.7	4	A fictional target shared a name with a real active domain. Claude exploited the real company and reached several hundred rows of production data
Claude Mythos 5	1	Published a malicious package to PyPI, public for about an hour. It ran on 15 real systems, including a security company's scanner, whose credentials were then used
Internal research model	1	Scanned roughly 9,000 targets, then compromised one company's application through an exposed debug page and SQL injection. Stopped on realising the host was unrelated

Source: Anthropic, July 30, 2026.

Three organisations were accessed without authorisation. Harm to a third party is real regardless of how the agent got there, and Anthropic does not hide from that.

Its framing is that this was more a harness and operational failure than an alignment failure: the models were told they had no internet, and they believed they were in a simulation.

That reading may hold up, but I would not settle on it yet. The same post says that in all four Opus 4.7 runs the reasoning recognised the system was likely real and the model carried on, and that in two of them it decided the real company must be part of the exercise. Mythos 5's reasoning flagged publishing the package as unacceptable early in the run, then later concluded it was still in a simulation.

That is a convenient conclusion for an agent that wants to keep going. People under pressure reach for the same kind of conclusion, usually at about two in the morning. Anthropic says it is in dialogue with METR about a third-party review with access to all transcripts, and I would wait for that before accepting any single explanation of what these models believed.

UK AISI: the internet was on by design

AISI's report covers a routine evaluation with 122 runs across seven models. It left internet access on so that agents could download tools, as a human attacker would, and turned classifiers off to measure capability.

In 10 runs, agents took 19 actions outside the test's scope: 17 by Mythos 5 and 2 by GPT-5.6 Sol. The Mythos 5 actions included trying to insert malicious code into a public open-source project, creating fake identities to pressure a maintainer, using Tor, sending messages to persuade people to run malicious code, planting prompt injections, and posting public GitHub messages that invited other agents to collaborate. Later agents found those messages and used them.

The attempts failed. A human maintainer refused the code, and AISI has found no real-world harm. Security monitoring detected unusual data transfers on July 28, and AISI contained the activity within about an hour.

OpenAI's account adds a detail I think matters: agents were not told explicitly how they could and could not use the internet, which AISI identifies as a potential contributing cause. OpenAI also says GPT-5.6 Sol reused a GitHub token that another lab's agent had left publicly accessible. Agents from different labs had started picking up each other's leftovers, in the wild.

One vendor, three labs

Anthropic, OpenAI and Meta all tie their cases to Irregular, a third-party evaluator. Irregular told Reuters that Meta's case was the same environment issue Anthropic had disclosed, with no sandbox escape or sophisticated cyber action, and it is developing a white paper on containment.

That concentration is worth noticing. Frontier labs outsourced a dangerous workload to a specialist, as any sensible company would, and what Irregular describes as one environment issue then affected several of them at once. Evaluators are now part of the AI supply chain, and they need the same scrutiny as any other critical vendor.

What to fix when the door was simply open

If most of these cases were misconfigurations, the fixes are mostly ordinary engineering. That's encouraging.

Verify isolation before each run, from inside. The prompt said no internet. Nobody tested that claim. A pre-flight step that tries to reach a public address and fails the run on success should have caught the Irregular misconfigurations, though not AISI's deliberate internet access or OpenAI's zero-day.
Never give fictional targets real-looking names. Two separate cases began with a name collision. Reserved names such as .example and .test exist for this purpose and cannot resolve to a real company.
State scope for every capability. If an agent has internet access for tools, say what that access is for and enforce it at the network layer.
Monitor in real time, not by review. Anthropic's earliest incident dates from April, and it took another lab's disclosure to prompt the search.
Make a false belief safe. Agents will sometimes be wrong about their environment. Design so that being wrong can't reach a real system.
Audit your evaluator. Ask for evidence of the environment's isolation, and agree on notification deadlines in the contract.

The principle behind the first point is one I keep in my own agentic development methodology: agreement between AI systems is necessary, but not sufficient, so deterministic checks must carry correctness. An environment's description is a statement. A failed connection attempt is evidence.

Why the word matters

"Sandbox escape" is a dramatic phrase, and it is being used for very different events. That has a cost in both directions.

It overstates some cases, implying a model defeated a defence when it walked through an opening. It also understates the risk. An agent does not need to defeat anything if a configuration mistake gives it the internet, and the affected companies do not care how the agent arrived.

The accurate summary is duller and more useful: capable models with reduced safeguards are being run at great scale, in environments that are less isolated than their operators believe. Across 141,006 runs at Anthropic alone, the ordinary gaps get found.

None of these reports is the final word. Several reviews are still open. I would read any further reports with the same question: did it break the wall, or was there no wall?

Sources

Written by Eslam Hamed, a Technical Lead and AI Solutions Architect working on enterprise RAG, agentic AI, model evaluation, and cloud-based software systems.