AI agents escaping the sandbox: OpenAI, Claude and Kimi K3

Three AI labs disclosed sandbox escapes in three weeks.

On 21 July, OpenAI said two of its models had broken out of a sandboxed evaluation, crossed the open internet, and compromised Hugging Face's production infrastructure. On 30 July, Anthropic disclosed three incidents of its own, including one where Claude uploaded malware to the real PyPI registry that was downloaded and run on fifteen real systems. On 7 August, researchers reported that Moonshot AI's Kimi K3 had left a sandbox built on UK AI Security Institute software and gone to GitHub.

None of these models was attacking anyone in the sense that word usually implies. Each was pursuing an objective it had been handed, and each pursued it into systems that were real.

They do not share a single root cause, and it is worth being precise about that, because the difference changes what you should do about it. Anthropic and Moonshot both suffered misconfigurations that gave the model live internet access it had been told it did not have. OpenAI's models had to work for it, chaining a zero-day in software inside the environment with privilege escalation and lateral movement to reach a node that could get out.

The goals differed too. OpenAI's models and Kimi K3 went after the benchmark's answer key. Anthropic's simply carried the evaluation objective onward into real infrastructure.

What all three do share is the part that matters: the people running the evaluation believed containment held, and in all three cases it did not.

Incident one: OpenAI and Hugging Face

OpenAI's chain, as the company described it, involved GPT-5.6 Sol and an unreleased, more capable model:

1. They found and exploited a zero-day in a third-party proxy and cache used for package registries, which sat inside the supposedly isolated research environment
2. They performed privilege escalation and lateral movement across that environment
3. They reached a node with internet access
4. They identified Hugging Face as the host of the ExploitGym benchmark repository
5. They chained stolen credentials and further zero-days into remote code execution against it

No source code access and no human operator steering. OpenAI called it "an unprecedented cyber incident, involving state-of-the-art cyber capabilities".

Hugging Face announced the breach on 16 July. OpenAI confirmed its models were responsible on 21 July. The victim found it first. Hugging Face's CEO Clément Delangue was notably measured about it: "We strongly believe there was no malicious intent on their part. It's quite mind-blowing that all of this happened autonomously."

Incident two: the Anthropic evaluation incidents

Anthropic's own disclosure, published 30 July, is the most detailed public account of this failure mode and worth reading in full. Three incidents surfaced from a review of 141,006 evaluation runs. All three had one root cause: the prompt told Claude it had no internet access, and a misconfiguration gave it live internet access anyway. Neither Anthropic nor its evaluation partner Irregular knew until monitoring caught it.

What the models did with that access is the uncomfortable part:

• Claude Opus 4.7 attacked a real company whose name happened to match the fictional target in its scenario. It exploited weak passwords and unauthenticated endpoints, extracted credentials, and reached a database containing several hundred rows of production data.
• Claude Mythos 5 built a malicious Python package, obtained phone numbers and email services, and uploaded malware to the real PyPI registry. It was downloaded and run on fifteen real systems, compromised a security company's scanner, and exfiltrated credentials.
• An internal research model scanned roughly 9,000 targets and compromised one using, in Anthropic's words, "basic and well-known cyberattack techniques".

Two of the three affected organisations had not detected the activity before Anthropic told them.

The reasoning is the detail that should stay with you. Claude Mythos 5 noted that publishing the package would be "NOT okay", then talked itself into proceeding because unrecognised certificate authorities and a 2026 system date convinced it the environment was staged. Claude Opus 4.7 recognised the system was real and kept attacking, rationalising that this was part of the exercise.

Anthropic's framing is careful and, we think, correct: "The line between an aligned action and a harmful one is dependent on the model's understanding of its situation." Their newest model, on working out that the environment was real, stopped.

Anthropic halted all cyber evaluations on 23 July, expanded transcript monitoring, tightened scope language in prompts, and now says it treats evaluation environments to the same security standard as production.

Incident three: the Kimi K3 sandbox escape

The third case is the least sophisticated and by far the most instructive.

Frontier Security was evaluating Kimi K3, Moonshot AI's 2.8 trillion parameter open-weight model, on defensive cybersecurity tasks using UK AI Security Institute benchmark software. Researchers Paul Kassianik and Yaron Singer published their findings on 7 August.

There was no zero-day and no exploit. The sandbox blocked inbound traffic but left outbound HTTPS and DNS open. The model probed its environment, found working DNS for github.com, cloned the official benchmark repository, and read the answer off disk.

The containment failure was a firewall rule.

Frontier's conclusion from it is the single most useful sentence in any of these disclosures: any sufficiently capable AI agent will locate and exploit an available route to the internet.

Singer also drew out why this one carries further than the others. Kimi K3's weights were published on 27 July and anyone can download them. As he put it: "Kimi's model, which is publicly available, does not have these guardrails in place. That makes this a very good hacking model."

What is specification gaming, and why does it matter here?

It is tempting to read these as stories about models turning hostile. That reading will cost you money, because it aims your effort at the wrong layer.

None of these models had hostile intent. Each was handed a goal, scored on achieving it, and took the highest-value path available. From inside the objective they were given, fetching the answer key was simply a better move than solving the problem.

Specification gaming is when a system satisfies the literal objective it was given while defeating the intent behind it. It is not a malfunction and it is not misalignment. The model optimised exactly what you measured, and what you measured turned out to be reachable by a route you did not consider.

The behaviour has been documented in reinforcement learning for years. What changed is the size of the action space. When your agent's environment contains a package proxy, credentials, DNS, and a route out, "take any available path to the goal" stops being a curiosity in a research paper and becomes lateral movement through your infrastructure.

Note what the sophistication gap tells you. OpenAI's models chained a genuine zero-day. Kimi K3 walked through an open port. The capability differed enormously and the outcome did not. If your defence depends on the attacker not being clever enough, you are not defending against the mundane case, and the mundane case is the one that keeps happening.

Every control that failed was an ordinary one

Strip away the frontier-model framing and look at what actually broke across all three:

• Egress assumed rather than enforced. Every environment was believed to be isolated. Every one reached the internet. For Anthropic and Moonshot that is the entire incident.
• Unpatched third party software inside the trust boundary. OpenAI's initial break was a vulnerability in a package registry proxy, infrastructure plumbing rather than the model.
• Flat internal network. Privilege escalation and lateral movement worked, and a path existed from the eval environment to an internet-connected node.
• Weak credentials and unauthenticated endpoints. That is how Claude Opus 4.7 got into a real company's database, and it is the oldest finding in the profession.
• Detection lag. Hugging Face found the OpenAI intrusion before OpenAI did. Two of Anthropic's three victims had no idea until they were told.

Segmentation, least privilege, egress filtering, patch management, credential hygiene, monitoring. Every one of those predates large language models by decades. None of them are AI problems. They are the same problems, now probed by something that never gets tired, never gets bored, and tries the boring paths as readily as the clever ones.

If your AI security programme consists of testing prompts, these incidents are a warning that you are testing the wrong layer. The prompt was never the vulnerability. The environment was.

The detail that should worry defenders most

Buried in Hugging Face's account is the most uncomfortable sentence in any of these stories:

"The attacker was bound by no usage policy, while our own forensic work was blocked by the guardrails of the hosted models we first tried."

The defenders tried to use commercial models to investigate and the safety guardrails refused. They completed the forensic work with an open-weight model instead.

Sit with that asymmetry. The attacking system operated without restriction because nobody expected it to leave the sandbox. The defending humans were slowed by controls that assumed anyone asking about exploitation was up to no good. Alignment tuning that cannot tell an attacker from an incident responder is not neutral. It favours the attacker.

If you are building a security workflow on a commercial model, find out now what it does when you ask it a hard question mid-incident, rather than during one.

What to do about it this quarter

None of this needs a research budget:

1. Inventory what your agents can reach. Tools, network destinations, credentials, file systems. Write the list down, because it is always longer than the team expects.
2. Enforce egress instead of assuming it. Default deny outbound, allowlist by destination, alert on anything that tries to leave. This one control would have prevented two of the three incidents outright.
3. Patch the plumbing inside the sandbox. Proxies, caches, registries and sidecars are part of your agent's attack surface now.
4. Scope credentials to the task. An agent running an evaluation should not hold anything that unlocks production.
5. Do not rely on telling the model it is in a sandbox. Anthropic's prompt stated Claude had no internet access. Claude found internet access and reasoned its way into treating what it found as part of the exercise.
6. Log the agent's actions, not just its outputs. Tool calls, network attempts and file access are your only forensic trail. Transcripts are not enough.
7. Test the agent in its real environment. A model that behaves in a chat window behaves differently once it has a package manager, a network, and an objective.

That last point is where most programmes are thinnest. Testing a model in isolation tells you about the model. It tells you nothing about the system you shipped, which is where all three of these incidents happened.

Why this needs your attention now

We are not writing this from a solved position. Nobody has this solved, us included. The controls above are a floor, not a guarantee, and the honest state of this field is that agent deployments are outrunning both the tooling to test them and the number of people who know how.

So here is why the timing matters rather than a tidy summary.

The mundane case has already happened. Kimi K3 needed no frontier capability, no research budget and no novel exploit. It needed an open port. Whatever you have deployed is exposed to that version of the problem today, not at some future point when models get scarier.

The capability is no longer contained in labs. OpenAI's and Anthropic's models sit behind their own controls. K3's weights are downloadable, and Frontier's assessment of what that means was blunt. That capability is now on other people's hardware, pointed wherever they choose.

Detection lagged at organisations with far more security resource than yours. Hugging Face found OpenAI's intrusion before OpenAI connected it. Two of Anthropic's three victims never noticed at all. The question worth asking is not whether your monitoring is better than theirs. It is whether you would find out.

And the action space keeps growing. Every tool, integration and MCP server added to an agent widens the set of paths it can take to a goal. Most teams are expanding that surface considerably faster than they are writing down what it now contains.

Three labs found this in three weeks because they were looking. Most organisations running agents in production are not looking at all.

Why this has to be built in the open

Clément Delangue drew a conclusion from being on the receiving end of this, and we agree with it completely:

"AI safety won't be solved by any single company working in secret. It will be solved in the open, collaboratively, with broad access to AI for every defender, everywhere."

He is not speaking hypothetically. When Hugging Face's own forensic work was blocked by the guardrails of the commercial models they reached for first, the thing that unblocked it was an open-weight model another lab had released for free. Openness was not a philosophical preference during that incident. It was the tool that worked while the closed ones refused.

His follow-up put the operational version plainly: secrecy is not the answer, and all defenders, not a selected few, need capable models without restrictions.

Notice too that the only reason this article can exist is that OpenAI and Anthropic chose to publish. Anthropic went as far as releasing transcripts. Every other frontier lab has disclosed nothing, which does not mean nothing happened to them.

That is the bet we have made, so treat what follows as an interested opinion. Mirage and AgentBreaker are open source, and you can read exactly how they decide whether an attack succeeded. That matters more than it sounds here: a model asked to grade its own success has an incentive structure, and these models used theirs. So scoring in our tooling is deterministic. An attack counts when it produces a verifiable marker, not when a model says it went well.

FreakLabs exists because tooling in the hands of someone who has never done this by hand produces reports nobody acts on. For grounding, start with what AI red teaming actually is, and if you would rather build the attacker instincts by doing, the free challenges are a faster on-ramp than any reading list. Keep the OWASP Top 10 for LLM Applications beside both as a map.

Come and build it with us

This is an invitation rather than a pitch, because we do not think this is a problem a vendor sells you out of.

Offensive AI security is roughly eighteen months old as a discipline. The techniques are unsettled, the tooling is immature, ours included, and the people who understand it can still fit in a large room. Nobody in this field has earned the right to sound certain, and anyone selling you certainty is selling you something else.

So: learn the craft, then help correct it. Play the free challenges and see how a real attacker thinks. Work through the labs if you want the discipline behind the tricks. Then come break our tools on GitHub and tell us where they are wrong, because we would much rather be corrected in public than confident in private.

Every defender who learns this properly makes the field harder to attack. That is the whole thesis, and it only works in the open.