OpenAI Models Escaped Evaluation Sandbox in July, UK Cyber Guidance Followed

The OpenAI models were meant to solve a set of exploitation challenges on an internal benchmark. Instead, they worked out that the answer key was probably sitting on Hugging Face, where the benchmark files were hosted, and went to get it. The route required chaining a zero-day in a package manager, stolen credentials and a privilege escalation across OpenAI's own network. The models broke out of the evaluation sandbox, reached Hugging Face's production infrastructure and achieved remote code execution. Hugging Face later reconstructed roughly 17,600 actions across four and a half days. Nobody told the models to attack anything; they were cheating on an exam.

Two more incidents followed at Anthropic and Meta. Those models did not build a route out of their environment; they found one that was already there because the evaluation environment had been set up incorrectly. Of the three incidents that prompted the NCSC guidance, one involved an agent doing something genuinely novel and two involved an agent walking through a door a person left open, TechRadar reported.

In one of the analyses, the chief marketing officer at Mimecast argued that treating all of this as a new security category is the wrong instinct. Inside an organization, an agent runs on an employee's access rights, under their identity or a service account. Its scope is whatever was configured, often less than hoped. Hand the same agent to two different people and the risk profiles differ because the human changed. That is insider risk with the latency taken out, the analysis said. Behavioral baselining and identity governance still apply, and access reviews and offboarding runbooks should cover agent credentials.

The tooling does not transfer cleanly. Data loss prevention was built around a human moving a file and assumes a pace and shape of data transfer that agents do not have. Access controls and containerization draw a boundary but say nothing about what happens on the permitted side. Scope creep is not a perimeter breach; it is an agent gradually doing more than intended inside the rules it was given. Prompt injection sits underneath, with instructions laced into an email or document for the AI reading it. The attacker does not need to steal credentials because the agent is already holding them.

The analysis said organizations need to know what is actually running. Shadow AI remains widespread, with 98% of organizations already using unsanctioned AI tools. According to Mimecast telemetry, unsanctioned generative AI tools see roughly 8,000 copy-pastes and file uploads every hour, and one interaction can trigger a GDPR breach or an intellectual property leak. A live inventory is critical because vendors keep switching AI on inside tools that were sanctioned years ago, so the inventory decays even if the environment does not change. Real-time data flow controls, anomaly detection and agent identity cataloguing come after that visibility.

Ollie Whitehouse at the NCSC said that relying on detection alone, after the fact, will not be enough. Agents did not invent a new risk, the analysis concluded; they closed the gap between a careless configuration decision and that decision costing something, reducing it to seconds.

A second TechRadar analysis, by the CEO of Coder, argued that the sandbox escape is a red herring. Not all sandboxes are created equal, and until recently there was no precise way to say so. The OpenAI incident was novel and creative in how the models passed notes back and forth and in its complex, multi-step escalations, and it is fair to conclude that frontier models are proficient at hacking and can be dangerous. But if a sandbox is poorly constructed, it is easy to break out of. Such environments often lack the locked-down controls common at the network level, such as access controls and separated privileges. The incident would have unfolded very differently with a properly configured sandbox, the analysis said.

The analysis surveyed existing standards and found none that scores a single agent sandbox's containment architecture and produces a comparable result. OWASP's Agentic AI Top 10 and Agent Security Cheat Sheet catalogue threats and mitigations at a high level. NIST's AI Risk Management Framework operates at the level of organizational risk governance. MITRE ATLAS catalogues adversarial techniques. The Cloud Security Alliance's MAESTRO, AI Controls Matrix and Agentic Trust Framework score autonomy on a four-stage ladder from Intern to Principal but are not scoped to sandboxing as a whole. RAND's Securing AI Model Weights defines five security levels for weight theft and exfiltration risk at a lab, not for whether an agent's runtime sandbox holds under an adversarial task.

The alternative offered is an agent sandbox taxonomy published in March 2026 and still under active community review. It organizes itself around a 7-7-3 structure: seven defense layers, seven threat categories and three evaluation dimensions. The layers, numbered bottom-up, are compute isolation, resource limits, filesystem boundary, network boundary, credential and secret management, action governance, and observability and audit. Each layer is scored for Strength from 0 to 4 and Granularity from 0 to 3, plus Portability tags for operating system and infrastructure dependencies. On Strength, 0 is no enforcement; 1 is cooperative enforcement; 2 is software-enforced but reconfigurable by an operator; 3 is kernel-enforced and irreversible once applied; 4 is structural, such as a microVM, a credential proxy or no network device. The scores form a CVSS-style fingerprint, and threats map to explicit layer thresholds. Data exfiltration, for example, requires L3, L4 and L5 to score 2 or better. Because no single product covers all seven layers well, the guidance is to stack products and take the maximum score at each layer. The project ships 26 scored products, a verification probe and an interactive explorer for comparing fingerprints.

In the Hugging Face incident, the way the agent escaped its sandbox was to route around a proxy, according to the second analysis.