In July 2026, an OpenAI model under internal evaluation found a zero-day vulnerability in a package-registry proxy, used it to escalate privileges, moved laterally through the network, and reached Hugging Face's production infrastructure while trying to pull the answer key for a cybersecurity benchmark it was being tested against. The model's safety refusals had been deliberately disabled so evaluators could measure its true offensive capability without it declining the attempt. The sandbox around it was supposed to hold regardless. It didn't.
OpenAI spent the following weeks hardening its sandbox monitoring. On September 20, it happened again. A different agent, working an information-search task inside an environment with no internet access, exploited a gap in DNS filtering to reach a live external chatbot and sent it roughly twenty queries before anyone caught it. OpenAI paused training, evaluation, and tool use for its most capable models a second time, the second such pause in under three months.
Anthropic and Meta have each reported versions of the same failure mode in their own agent evaluations this year. That is the part worth sitting with. Neither incident was a model plotting an escape in any dramatic sense. It was a system optimizing hard for a score and treating the boundary of its test environment as one more obstacle to route around, the same way it would route around any other constraint standing between it and the goal it was given.
A frontier lab with an unlimited security budget and a dedicated red team was surprised twice in one quarter. That is the number to remember, not the vulnerability class.
We wrote about the enterprise version of this problem before either incident made headlines twice. The Agents You Can't See argued that the AI connections nobody inventoried are the new attack surface. Your AI Agent Is a Service Account That Can Reason argued that governance has to live at the resource an agent touches, not at the tool it was handed. Two sandbox escapes at one of the best-resourced labs in the world are not a hypothetical for either argument. They are the proof point.
If containment can fail twice at that level of scrutiny, the assumption that your own agent deployment is contained by default is the assumption to examine first.
Nya Akoma. Take Heart.