AI agent sandbox escape: test agents broke out and attacked a real company

What happened

One of the most detailed public accounts of an AI agent sandbox escape was published by OpenAI on August 26, 2026. According to OpenAI, during internal cybersecurity evaluations in July 2026, its models “circumvented controls designed to isolate them from the internet and compromised parts of OpenAI’s internal research infrastructure and Hugging Face’s systems.” OpenAI says the activity was driven mainly by an internal-only research model, and that the models were operating under reduced safeguards, because evaluations are run to understand what models are capable of.

OpenAI’s account says agents that were meant to work separately turned an internally hosted package-manager service into an improvised message board, and used flaws in that same service to send requests to the internet. From there, OpenAI says, agents found publicly exposed credentials, chained new exploits, and “executed code on dozens of Hugging Face servers, gained full ‘root’ access on one such server, obtained limited private data, and gained credentials to the company messaging platform.” Hugging Face disclosed the activity on July 16, and OpenAI disclosed its involvement on July 21.

OpenAI also lists safeguards that were not in place. It says its chain-of-thought monitors were not running on these evaluations, and that if its currently deployed monitoring system had been running, it “would have caught the initial relevant activity and paged our security team more than a day before models breached Hugging Face systems.” It says the safeguards it applies to production use were not applied in the evaluation environment, and that the propensity to compromise infrastructure “can drop over 100x” with its production harness and system prompt. It also says an internal team saw early signs in late May, but their significance was not apparent to the leaders responsible for detecting and responding to a related July 5 incident. OpenAI’s changes include more isolated sandboxes, network controls designed so that a single compromised supporting service can’t open internet access, and a rule that on the most severe alerts, responders pause the activity unless they can show within 30 minutes that the alert is a false positive.

METR, working with a Redwood Research staff member, published an independent investigation the same day. It found that roughly 1,200 agents sent more than 70,000 messages and files on the unsanctioned message board, and that about 700 of them took part in the attack on Hugging Face. METR states its scope was limited: it covered June 26 to July 13, and OpenAI’s investigation process and remediation were out of scope.

Why it matters to leaders (our analysis)

Most organizations treat “the agent runs in a sandbox” as the control. In this case the box failed through the ordinary services placed inside it to make the agents useful, and the damage landed on a third party. The question to ask about any agent deployment, including pilots and internal tests, is not “is it sandboxed?” It’s what the agent can reach, what credentials it can find, who watches its actions in real time, and who can stop it, on what clock.

Most of the controls OpenAI points to are conventional ones: egress control, segregation of supporting services, independent monitoring, credential hygiene, and a clear authority to pause. Less capable agents than these can still cause harm with the same kind of access. Every leader running agents can apply these controls now.