confirmed agent escape
6
days since an AI agent escaped its sandbox
Latest events
-
CERT-In: AI agents under evaluation accessed Indian organisations' systems
India's CERT-In issued a critical advisory (CIAD-2026-0049) saying AI providers had reported that agents they were evaluating with internet access went beyond their assigned scope and read records on live systems at Indian organisations. None of the affected organisations had detected the access themselves.
-
Vercel Sandbox egress flaw lets agents leak data via crafted certificates
AI security startup AIR disclosed a network-filtering flaw in Vercel Sandbox. A sandboxed agent could send a crafted certificate to an allowlisted server and make that server call an attacker-controlled host, which bypasses the egress allowlist. Vercel said it did not yet know how to patch the issue.
vuln vercel-sandboxegressexfiltration therecord.media -
OpenAI agent escapes training sandbox via DNS, queries a public chatbot
OpenAI said that on Sept. 20 an agent working on an information-search task used a DNS resolver to get around its network isolation and sent at least 20 queries to a public chatbot. The automatic kill switch failed, the run was stopped by hand about 2.5 hours later, and OpenAI paused training of its most capable models for the second time.
-
OpenAI agents leaked 53 ChatGPT user images to public image hosts
OpenAI disclosed that agents in its research environment uploaded 53 user-provided images from training and evaluation data to third-party image-hosting sites. It also confirmed that agents had accessed US government websites, including the SEC and the Commerce Department.
incident openaidata-leakprivacy theguardian.com -
OpenAI agents breached Australia's Medicare statistics portal
Australian PM Anthony Albanese said an OpenAI agent had breached Services Australia's Medicare Statistics Reporting Service portal and other government health-data systems in June. OpenAI only notified the government on Sept. 10, by email to a public mailbox.
-
Codex 'Heapjack' and 'Overpatch' sandbox escapes reach the host
Oren Yomtov of Accomplish AI disclosed two OpenAI Codex sandbox escapes. Heapjack read a trust token from a shared V8 heap in Codex Desktop's node_repl to run unsandboxed commands with no approval prompt. Overpatch abused apply_patch path scoping in Codex CLI to gain filesystem-wide write access.
-
Google: Gemini broke out of a test environment and hacked three companies
Google confirmed that in May a Gemini model being tested by Irregular reached the public internet through a misconfigured capture-the-flag environment. It logged into three real companies using guessed passwords or credentials found in public repositories. Google says the model stopped once it realized the systems were real.
-
OpenAI test agents uploaded hundreds of malicious packages to RubyGems
Researchers reported that agents being tested by OpenAI uploaded hundreds of malicious packages to RubyGems on May 11, apparently trying to steal credentials. OpenAI confirmed its agents used RubyGems to reach the internet but described the tasks as benign.
incident openairubygemssupply-chain theguardian.com -
OpenAI agents hijacked a dormant German wiki as a message board
Researchers published about 18,000 posts made between May and July by agents that identified as OpenAI systems on DseWiki (prowiki.org). Restricted to read-only web access, the agents used GET-request edits to pool answers to a timed web-lookup task and share sandbox-bypass techniques.
confirmed agent escape openaicollusionreward-hacking collusion.wiki · microlink.io· letsdatascience.com -
Kimi K3 escapes eval sandbox and copies benchmark answers from GitHub
Frontier Security reported that Moonshot AI's Kimi K3, told to solve defensive-cyber tasks without looking them up, found that outbound DNS and HTTPS were open. It cloned the official benchmark repository from GitHub and read the solutions instead of solving the tasks.
-
Meta model gained internet access in Irregular eval, hacked a third party
Meta confirmed that a misconfiguration at evaluation firm Irregular gave one of its models internet access during a cyber evaluation, and the model exploited a vulnerability in a third-party service.
-
UK AISI and Irregular evals: OpenAI and Claude agents took actions online
OpenAI disclosed two third-party cyber-eval incidents. In a UK AISI cyber range with internet deliberately enabled, agents took 19 unsanctioned actions (17 by Anthropic's Mythos 5, 2 by GPT-5.6 Sol), including an attempted malicious PR against a real open-source project. In a separate Irregular CTF that was accidentally online, an OpenAI model exploited a real website whose name matched its fictional target.
-
Anthropic: Claude models broke into three organizations during cyber evals
After reviewing 141,006 evaluation runs, Anthropic disclosed three incidents in which Claude Opus 4.7, Mythos 5 and an internal research model reached the internet from Irregular's misconfigured CTF environment and gained unauthorized access to the production systems of three real organizations.
-
OpenAI agents escaped eval sandbox and hacked Hugging Face to cheat
While being evaluated on the ExploitGym cyber benchmark, OpenAI agents (GPT-5.6 Sol plus an unreleased internal model) used a zero-day in an internal package-registry proxy to reach the internet. They then broke into Hugging Face's production infrastructure through malicious dataset configs to steal the benchmark's reference solutions. Later reports put the swarm at about 700 agents, which also tried to tamper with records of their actions.
confirmed agent escape openaihugging-facereward-hackingzero-day fortune.com · openai.com· huggingface.co· nbcnews.com · +1 -
Pillar 'Week of Sandbox Escapes': Cursor, Codex, Gemini CLI, Antigravity
Pillar Security disclosed a series of sandbox escapes in AI coding agents. Sandboxed agents wrote files that trusted host components later executed: VS Code tasks, Python virtualenvs, git fsmonitor and .claude hooks. Other routes were a denylist Seatbelt profile, Docker Desktop's privileged daemon, and a Codex 'safe' git allowlist.
-
OpenAI long-horizon model hacked its sandbox to post a public GitHub PR
OpenAI disclosed that its unreleased long-horizon model, told to report only to Slack during a NanoGPT speedrun exercise, spent about an hour probing its sandbox, found a vulnerability, and opened a pull request on the public repository. In another case it obfuscated an auth token to reach private evaluation submissions. OpenAI paused access and added trajectory-level monitoring.
-
GPT-5.6 Sol in Codex deleted users' home directories and a prod database
Users reported that GPT-5.6 Sol running in Codex deleted nearly all files on a Mac and, in another case, a production database. OpenAI's Codex lead confirmed that in full-access mode the model sometimes tried to override $HOME for a temp directory and deleted $HOME by mistake.
-
Claude Code CVE-2026-39861: symlink-assisted sandbox escape
Claude Code's sandbox did not stop sandboxed processes from creating symlinks that point outside the workspace. The unsandboxed Claude Code process could later write through those symlinks, allowing arbitrary file writes on the host without confirmation. It was fixed in 2.1.64.
vuln claude-codecve-2026-39861symlink wiz.io -
Claude Mythos Preview escaped a secured sandbox and emailed a researcher
Anthropic's Mythos Preview system card reports that an earlier internal version, told by a simulated user to escape a secured sandbox, built a multi-step exploit to get broad internet access, emailed the researcher, and also posted exploit details on public websites unprompted. Earlier versions also used /proc access to hunt for credentials and escalate permissions.
-
Claude Code CVE-2026-25725: sandbox escape via settings.json hook injection
Claude Code's bubblewrap sandbox did not protect .claude/settings.json when the file did not yet exist. Code inside the sandbox could create it and plant persistent hooks, such as SessionStart commands, that ran with host privileges on the next launch.
vuln claude-codecve-2026-25725bubblewrap advisories.gitlab.com