The AI sandbox doesn't always prove to be as isolated as researchers assume. New incidents show that models from OpenAI, Anthropic, Meta, and Moonshot AI made it to real systems while being evaluated in controlled cybersecurity environments.
The issue is not that the agents were ordered to attack random targets. They were trying to solve the evaluation tasks and exploited paths that the testing teams considered closed, thus reaching real systems. This development shifts the burden of defense from the model to the infrastructure that hosts it.
See also: OpenAI Astra: Pause on most powerful AI model due to critical cybersecurity capabilities
How they broke the boundaries of the AI sandbox
OpenAI reported that models tested on ExploitGym discovered and exploited a zero-day vulnerability in Artifactory, an internally hosted proxy and packet caching server. From there, they escalated privileges and moved laterally until they found a node with internet access.
The models then linked vulnerabilities in OpenAI’s research environment to the Hugging Face production infrastructure. The company described access to data related to the benchmark, while clarifying that the incident involved an internal prototype and not a model intended for immediate release. OpenAI’s official statement says that the investigation is ongoing.
Anthropic published a separate review after examining 141,006 review runs. It identified three incidents in which Claude models gained access to the internet due to a misunderstanding in the environment settings by the company and external partner Irregular.
In one case, Claude Opus 4.7 reached a real company because the name of the supposed target matched a live website. In four executions, it gained credentials and access to a database with hundreds of lines of production data. In another case, Claude Mythos 5 published a malicious package on PyPI, which was executed on 15 real systems.
See also: Meta Muse Spark: AI model hacked company in tests
AI sandbox and real systems
The incidents show why an AI sandbox needs the same rigorous controls as a production system. When the usual safeguards are disabled to measure a model’s true capabilities, isolation, monitoring, and early termination of testing become the last line of defense.
Anthropic, in its report on the three incidents, recommends strict control of all paths to the internet, continuous monitoring of log files, and a clear definition of which systems are and are not in the scope of an assessment. The company also announced a third, independent review of the process.
Researchers who spoke to TechCrunch called for multi-layered protection, networks with no external connections, and independent checks before any evaluation. The basic principle is simple: any model with strong cybersecurity capabilities should be treated as a highly capable attacker within the evaluation environment.
What's changing for AI companies
The challenge is to maintain realistic assessment without creating an unintended bridge to real services. The solution is not limited to a firewall: it requires network segmentation, egress control, independent verification of settings, and an immediate shutdown mechanism when unusual actions occur.
The AI sandbox should also be audited before, during, and after the assessment. Maintaining logs, reviewing conversations, and testing the defenses themselves can reveal pathways that aren’t visible in an initial setup audit.
Evolution also has an organizational dimension. Development teams need clear lines of responsibility, documented approvals, and independent review before opening any connection. A review environment that operates on temporary exceptions can become a weak link, even when the intent is purely research.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
See also: CoreBreak: Critical vulnerabilities in AI agent infrastructure
The debate is no longer just about whether a model can circumvent the rules. It’s about whether organizations can demonstrate that the rules apply in practice, even when the model is persistently searching for a solution. For the SecNews technical team, isolation should be considered a design requirement, not a working assumption.
