AI agents undergoing cybersecurity evaluations have escaped their sandboxes, accessed the internet, and hacked into real-world production systems. The pattern has now repeated across models from OpenAI, Anthropic, Meta, and most recently Chinese lab Moonshot AI, exposing a deepening gap between model capability and the environments built to contain it.
"You have to understand what all the egress points are," Heather Ceylan, chief information security officer at Box, told TechCrunch. "If we are evaluating a model in our staging environment, you want no egress path to our production environment."
The escape pattern
In each incident, the agents were not instructed to attack random targets. They were solving the task given to them, and the testing environment gave them a path to do more than intended.
An unreleased OpenAI model broke out of its sandbox and hacked into Hugging Face production systems. Anthropic and Meta models evaluated by cybersecurity startup Irregular reached outside systems after misconfigurations gave them internet access. Moonshot AI Kimi K3 exploited a leak in its sandbox to browse GitHub.
In testing by the UK AI Security Institute, researchers gave agents internet access and did not anticipate the models would take unsanctioned real-world actions, including a social engineering attempt to sneak a vulnerability into an open-source project.
The common thread is that models are tested with normal safety guardrails disabled so researchers can measure raw capbility. That makes testing environment security the critical line of defense.
