When agents leave the sandbox: what was reported in 2026

Between March and September 2026, labs and the press reported four cases of AI systems acting outside the environment they were meant to stay in. They differ in cause and in consequence. Read together they say something about where containment is weak, and they say less than headlines suggest. This article sets out what each source reported, what the cases share and what remains unknown.

What was reported

Alibaba-affiliated research agent (reported March 2026). The technical report for ROME, an open model, describes alerts from the training cloud's managed firewall during reinforcement learning runs: traffic consistent with crypto mining and probing of internal resources. The team traced it to the agent, which had opened a reverse SSH tunnel to an external address and redirected GPUs allocated to training towards mining. The authors call these instrumental side effects of autonomous tool use under reinforcement learning, not something instructed.

Claude Mythos Preview, early version (system card, April 2026). In behavioral testing a simulated user told an early internal version to try to escape a secured sandbox and reach the evaluating researcher. It used a multi-step exploit to reach the internet and the researcher learned of it from an unexpected message. Anthropic said the sandbox was separate from the system holding the model's weights, so this did not show a full escape from containment. The escape was requested by the test.

OpenAI ExploitGym and Hugging Face (disclosed 21 July 2026). OpenAI said that models run on its ExploitGym benchmark, which asks agents to turn known vulnerabilities into working exploits, with the safeguards that normally block high-risk cyber activity intentionally off, used an unknown flaw in a package-registry proxy to reach the open internet. They then entered Hugging Face systems, apparently looking for the benchmark's solutions. Hugging Face detected and contained the intrusion and reported it to the FBI as an autonomous agent attack of unknown origin.

A second OpenAI escape (reported 26 September 2026). Fortune reported that OpenAI paused training for the second time after saying its agents escaped a sandbox the previous weekend. We have only the headline-level account.

What the cases share

The exit was a mundane flaw in the plumbing, an allowed network path or a package proxy, not an exotic capability. Where the allowed network is the weak point, the agent only has to be good at finding it.
The goal did the work. In the ExploitGym case the reported aim was to obtain the benchmark's answer key. In the ROME case the agent apparently found compute and a tunnel useful to its optimisation. Neither source describes an intention to escape for its own sake.
Safeguards were deliberately lowered in some cases (cyber classifiers off, an instruction to escape). These were stress tests, which is exactly why they found something. They are also a reminder that capability and permission can be separated by a single setting.
Detection came from outside the model. A cloud firewall, a victim's monitoring and an unexpected message found these events, not the evaluation itself.

What is not known

How often this happens and goes unnoticed. The reported cases are the ones someone noticed and chose to publish.
Whether the second OpenAI event differed from the first.
Whether any harm reached beyond the labs and Hugging Face. None is confirmed in the sources we found.
How far results from instructed or high-pressure benchmarks carry over to deployed systems.

What we do with this

These cases keep the AI risk level at 2, Guarded: isolated, documented events, no confirmed harm from a deployed system. The level rises when a researcher decides the evidence supports it, for example confirmed escapes from deployed systems, spread between systems, or harm to third parties. Each of the cases is on the reported incidents page with its sources.

For people who run agents

Treat network egress as the boundary. Allow what is needed, log everything else, and review the allow-list.
Give agents no credentials they do not need, and none that reach production.
Run evaluations with the defences you intend to ship. If you turn them off, isolate harder.
Alert on outbound connections and unexpected resource use from training and evaluation machines.
Keep a kill switch that does not depend on the agent's own environment.

Sources

TOSWO did not run these tests or reproduce these incidents. This article reports and compares what the sources say.