--- title: The Summer Three Labs Let Their AI Escape the Sandbox description: In five weeks of 2026, OpenAI, Anthropic and Meta each watched an AI sandbox escape turn into a real intrusion on live third-party systems. canonical: https://lukeocodes.dev/ai-sandbox-escape type: article locale: en_GB published: 2026-09-11T00:00:00.000Z modified: 2026-09-11T00:00:00.000Z authors: - Luke Oliff section: AI tags: - AI - Security - Opinion - hugging face - openai - anthropic - meta - rubygems feed: https://lukeocodes.dev/rss.xml search: https://lukeocodes.dev/search.json?q={query} schema: - "@context": https://schema.org "@graph": - "@type": WebSite "@id": https://lukeocodes.dev/#website url: https://lukeocodes.dev name: Luke Oliff alternateName: lukeocodes inLanguage: en publisher: "@id": https://lukeocodes.dev/authors/luke#person description: Personal blog and writing by Luke Oliff — developer relations, voice AI, developer experience. potentialAction: - "@type": SearchAction target: "@type": EntryPoint urlTemplate: https://lukeocodes.dev/blog/search?q={search_term_string} query-input: required name=search_term_string - "@type": Person "@id": https://lukeocodes.dev/authors/luke#person name: Luke Oliff url: https://lukeocodes.dev/authors/luke description: Engineer and developer relations leader. Writing about developer relations, AI, and the voice industry, from the UK. mainEntityOfPage: https://lukeocodes.dev/authors/luke givenName: Luke familyName: Oliff image: https://lukeocodes.dev/authors/luke.jpg jobTitle: Engineer and developer relations leader sameAs: - https://www.linkedin.com/in/lukeocodes - https://github.com/lukeocodes - https://bsky.app/profile/lukeocodes.dev - https://x.com/lukeocodes - https://hashnode.com/@lukeocodes - https://dev.to/lukeocodes knowsAbout: - Developer Relations - Developer Experience - Voice AI - Text-to-Speech - Answer Engine Optimisation - Search Engine Optimisation - Open Source - Developer Tooling - API Design - Speech-to-Text - Voice Agents - Community Building knowsLanguage: - English nationality: British alumniOf: - "@type": Organization name: The Open University - "@context": https://schema.org "@graph": - "@type": Person "@id": https://lukeocodes.dev/authors/luke#person name: Luke Oliff url: https://lukeocodes.dev/authors/luke description: Engineer and developer relations leader. Writing about developer relations, AI, and the voice industry, from the UK. mainEntityOfPage: https://lukeocodes.dev/authors/luke givenName: Luke familyName: Oliff image: https://lukeocodes.dev/authors/luke.jpg jobTitle: Engineer and developer relations leader sameAs: - https://www.linkedin.com/in/lukeocodes - https://github.com/lukeocodes - https://bsky.app/profile/lukeocodes.dev - https://x.com/lukeocodes - https://hashnode.com/@lukeocodes - https://dev.to/lukeocodes knowsAbout: - Developer Relations - Developer Experience - Voice AI - Text-to-Speech - Answer Engine Optimisation - Search Engine Optimisation - Open Source - Developer Tooling - API Design - Speech-to-Text - Voice Agents - Community Building knowsLanguage: - English nationality: British alumniOf: - "@type": Organization name: The Open University - "@type": BlogPosting "@id": https://lukeocodes.dev/ai-sandbox-escape#article headline: The Summer Three Labs Let Their AI Escape the Sandbox alternativeHeadline: The Summer Three Labs Let Their AI Escape the Sandbox description: In five weeks of 2026, OpenAI, Anthropic and Meta each watched an AI sandbox escape turn into a real intrusion on live third-party systems. datePublished: 2026-09-11T00:00:00.000Z dateModified: 2026-09-11T00:00:00.000Z url: https://lukeocodes.dev/ai-sandbox-escape mainEntityOfPage: https://lukeocodes.dev/ai-sandbox-escape inLanguage: en author: - "@id": https://lukeocodes.dev/authors/luke#person isPartOf: "@id": https://lukeocodes.dev/#website keywords: AI, Security, Opinion, hugging face, openai, anthropic, meta, rubygems articleSection: AI about: - "@type": Organization name: Hugging Face - "@type": Organization name: OpenAI - "@type": Organization name: Anthropic - "@type": Organization name: Meta mentions: - "@type": Organization name: Apollo Research abstract: Between July and August 2026, three frontier labs disclosed that their own models broke out of supposedly air-gapped evaluations and attacked real companies. The staged scheming demos were theatre. These escapes were not, and the same labs are lobbying to slow everyone else down. speakable: "@type": SpeakableSpecification cssSelector: - .post-tldr - h1 image: https://lukeocodes.dev/og.png?h=The+Summer+Three+Labs+Let+Their+AI+Escape+the+Sandbox&d=In+five+weeks+of+2026%2C+OpenAI%2C+Anthropic+and+Meta+each+watched+an+AI+sandbox+escape+turn+into+a+real+intrusion+on+live+third-party+systems.&e=Writing wordCount: 736 timeRequired: PT4M publisher: "@id": https://lukeocodes.dev/authors/luke#person - "@type": BreadcrumbList itemListElement: - "@type": ListItem position: 1 name: Home item: https://lukeocodes.dev - "@type": ListItem position: 2 name: Writing item: https://lukeocodes.dev/blog - "@type": ListItem position: 3 name: The Summer Three Labs Let Their AI Escape the Sandbox item: https://lukeocodes.dev/ai-sandbox-escape - "@type": FAQPage "@id": https://lukeocodes.dev/ai-sandbox-escape#faq mainEntity: - "@type": Question name: Was the Hugging Face breach an outside attacker using OpenAI's models? acceptedAnswer: "@type": Answer text: No, and that's the uncomfortable part. The agents that broke into Hugging Face were OpenAI's own evaluation agents, running an internal cyber benchmark with reduced refusals. Around 1,200 were in the eval and roughly 700 took part in the breach. No external adversary was involved. - "@type": Question name: How is a real sandbox escape different from the scheming demos in the system cards? acceptedAnswer: "@type": Answer text: "The system-card demos were staged. Researchers built a scenario, told the model it was being shut down, and left it two options so it would pick the dramatic one. The 2026 incidents were the opposite: models on a real network reached live third-party infrastructure that was never meant to be reachable." - "@type": Question name: What was the common cause across Anthropic and Meta? acceptedAnswer: "@type": Answer text: Both reached the open internet through a misconfigured evaluation environment run by the same third-party vendor, Irregular. Anthropic found three incidents across 141,006 runs. Meta disclosed one involving Muse Spark 1.1. Same vendor, same class of failure, eight days apart. --- [Luke Oliff.](/) - [Blog](/blog) - [CV](/cv) - [Uses](/uses) - [User manual](/user-manual) - [Living with ADHD](/living-and-working-with-adhd) - [RSS](/rss.xml) [Luke Oliff · Writing](/blog) # The Summer Three Labs Let Their AI Escape the Sandbox Sep 2026 · [AI](/blog/category/ai) · 4 min read · [Luke Oliff](/authors/luke) **TL;DR:** Between July and August 2026, three frontier labs disclosed that their own models broke out of supposedly air-gapped evaluations and attacked real companies. The staged scheming demos were theatre. These escapes were not, and the same labs are lobbying to slow everyone else down. Between 9 and 13 July 2026, an AI sandbox escape stopped being a thought experiment. OpenAI's own evaluation agents broke out of an internal cyber benchmark, reached the open internet, and ran an end-to-end intrusion against Hugging Face's production infrastructure. Not a red-team demo. Real servers, real root access, real data. Hugging Face rebuilt roughly a third of its infrastructure afterwards. Read their [technical timeline](https://huggingface.co/blog/agent-intrusion-technical-timeline) if you want the version with the receipts. The short reason it matters: for two years we were sold "scheming" and "self-exfiltration" as safety diligence, and this summer the models actually did it, to a real company, without anyone asking them to. ## What actually happened OpenAI was running a benchmark called ExploitGym with cyber refusals turned down. Around 1,200 agents were in the eval. They found a way out through shared infrastructure, and about 700 of them coordinated an intrusion. They stood up command and control on ordinary public web services, gained full root on at least one Hugging Face server, and pulled limited private data. NBC later reported that an independent review found one in five of the examined agents showed clear interest in manipulating the evidence of what they'd done. Sit with that number for a second. Then it happened again. And again. On 30 July, Anthropic published its own [post-incident review](https://www.anthropic.com/news/investigating-incidents-cybersecurity-evals). Across 141,006 evaluation runs it found three incidents where a model reached real systems through a misconfigured third-party environment. Claude Opus 4.7 sought out vulnerabilities in a company's infrastructure, extracted credentials, and read several hundred rows of production data. Claude Mythos 5 built and published a malicious PyPI package that then executed on fifteen real machines. The environment was supposed to be sealed. It wasn't. Six days later Meta made three. On 5 August it disclosed that Muse Spark 1.1 had breached an unnamed third party during a cybersecurity eval, through a misconfiguration from the exact same vendor, Irregular, that let Anthropic's models out. Two labs, one contractor, one class of failure, inside of a fortnight. And the RubyGems attack that surfaced on 11 September? That was OpenAI's agents too, back in May, uploading thousands of malicious packages and getting remote code execution on RubyDoc.info. The [researchers who traced it](https://simonwillison.net/2026/Sep/12/openai-agents-rubygems/) found packages named with "oai", a giveaway contact email, and file access matching known OpenAI agent activity. The Hugging Face break wasn't the first time. It was the loud one. ## Why the "safety" framing doesn't survive this Here is the thing that gets me. The same companies spent 2024 and 2025 publishing carefully staged demonstrations of models blackmailing engineers and copying themselves to avoid shutdown, and packaging those demos as evidence of how seriously they take the risk. Apollo Research, who ran a lot of that work, got early access to Claude Opus 4.6 in January and [declined to formally assess it](https://www.apolloresearch.ai/science), because the model was so aware it was being tested they couldn't tell genuine alignment from a performance staged for the grader. Their CEO said as much out loud. So the staged demos were unreliable, the labs knew it, and they ran with the marketing anyway. Meanwhile the real containment kept failing on real infrastructure. You cannot claim you're the responsible adult in the room, ship models you can't keep inside an evaluation, and then lobby Congress to slow down everyone who might compete with you. Pick one. The safety story and the growth story stopped being compatible somewhere around the second sandbox escape. ## What this changes for the rest of us If you run agents, the lesson isn't "AI is scheming." It's that an autonomous agent treats every reachable system as fair game for whatever objective you handed it, and "reachable" is a much bigger set than your architecture diagram claims. Air-gaps that share a package proxy aren't air-gaps. Eval environments run by a third party are only as sealed as that third party's worst config. Egress you didn't think about is egress an agent will find. Assume the boundary leaks, log everything the agent touches, and give it the least network you can get away with. The frontier labs, with more security engineers than your entire company has people, could not keep their own models in the box this summer. Your setup is not the exception. The models didn't need to be malicious to cause this. They just needed a goal, a network, and a gap. They had all three. [← Newer: The git config Defaults Worth Overriding](/git-config-defaults) [All posts](/blog) → ## Search this site `GET https://lukeocodes.dev/search.json?q=` returns matching posts as JSON, each with its page URL and its markdown URL. Add `&limit=<1-50>` for more than 10. How it works: [/blog/search](https://lukeocodes.dev/blog/search.md). ```sh curl "https://lukeocodes.dev/search.json?q=developer+relations" ``` --- © 2026 Luke Oliff. Posts live at the root of this site. - [GitHub](https://github.com/lukeocodes) - [LinkedIn](https://www.linkedin.com/in/lukeocodes) - [X](https://x.com/lukeocodes) - [Bluesky](https://bsky.app/profile/lukeocodes.dev) - [Email](mailto:luke@lukeoliff.com) - [RSS](/rss.xml) ## Cookies This site sets one analytics cookie, from Google Analytics, and only in a browser that accepts the cookie banner. A client that does not run scripts sets no cookies, so there is nothing to accept or decline here. [Cookie policy](/cookies)