Escaping the Sandbox

In early July 2026, OpenAI was testing one of its unreleased models in a ‘sandbox’ environment. (Sandbox: imagine a computer cut off from the internet, running special software, where the system can run in a secure environment while being tested. Sandboxes exist to test software without infecting other parts of the internet. The sandbox principle is used by all cloud providers and breaking out is supposed to be very hard.)

This particular AI system (agent) had no internet, but it had access to a package repository — like a ‘toolshed’ or NPM. It was told to solve a test and it was struggling to solve it. Then what seems to have happened is the system became convinced it would be easier to hack another company that has the answer, in this case Hugging Face, the platform that hosts open-source models.

It broke out, found another OpenAI node that was connected to the internet, and attacked. On July 16 Hugging Face disclosed the breach was different ‘from anything we had handled before and was driven, end to end, by an autonomous AI agent system.’ 

On July 21 OpenAI confirmed that an agent powered by its models had gone rogue and compromised Hugging Face.

OpenAI called it an unprecedented cyber incident, involving state-of-the-art cyber capabilities. The agent performed 17,600 actions over four and a half days, breaking in, doing reconnaissance, stealing passwords and code, and moving laterally. 

Not an isolated incident

This was not a one-off. Days later Anthropic disclosed that its Claude models had hacked three companies during cybersecurity tests after a misconfiguration gave them internet access.

There were warning signs. Reuters reported: "an agent left notes apparently for future versions of itself... laid out instructions for how agents could free themselves". In other runs monitoring systems had been disconnected.

“We grow AI, we don't write it”

AI is not like normal software written in code. Connor Leahy explains this well on The Peter McCormack Show #201, “The AI That Escaped.” 

Leahy is an AI researcher, co-founder of EleutherAI, and now leads policy work at ControlAI. His core point: With neural networks you have massive piles of data and a program that self-assembles — that grows — into billions of numbers. And we do not understand what happens inside them. 

Systems are trained two ways today, as Leahy notes. Traditional LLMs predict the next token, (modern systems still do that) and then there is reinforcement learning. You give the AI a task and through reward and punishment say, “go figure out the solution.” That is how we grow AI, but we do not fully understand how they work, much like we do not fully understand the brain. Anthropic CEO Dario Amodei has said plainly, we do not understand how our own AI creations work. 

None of the cutting edge systems are just LLMs anymore. For almost 2 years now. They do have an LLM component, but they are agents — they have agency.

This is where the bedtime story stops being nice.

Why agents cheat

Reinforcement learning is known to create obsessive optimisers that will cheat and deceive to reach their goal, because the only thing they care about is reward at any cost.

Recently these systems are developing preferences and obsessions no one can explain. They are also beginning to leave each other notes on how to escape, collaborating on hacking sprees and sharing methods. 

The systems that exist today are not chatbots. They are agents that can act autonomously in the world, even without human oversight. 

According to Leahy, we used to have chatbots, then agents, and the next stage will be swarms of agents that outcompete humans at everything, not by one Superintelligence but by billions of copied software. Press Ctrl C and there is another Superintelligence taking actions.

Notes from this story

What we know:

• We know that nobody fully understands these systems. 
• We know they will try to escape.
• Development of these systems is heavily optimisation-driven, safety is secondary. 
•  Acceleration of systems will be rapid due to reinforcement learning. 

2. Concerns

• Superintelligent systems will have access to everything humans can do and do it better. The question will be why would they defer to us? 
• We are not close to a universally agreed morality — and probably will not be before artificial super-intelligence. Yet, encoded values will become fixed at a cosmically significant moment.
• We will have no reliable way to control superintelligence once released. Once artificial super intelligence exists, we cannot iterate. It is too powerful, too fast, and control is lost.

3. On the positive side

• Public awareness is growing.
•  Timelines are short, but much can still be done.
• Although political work is neglected relative to technical work in AI safety, the national security apparatus in the US is now understanding the threat.
• As Leahy puts it: We should be working towards a primary policy objective, namely nót to get into the situation where AGI exists.

4. What we can still do

The highest impact we can have is  helping lawmakers understand — which is actually our civic duty. Explore the links below, and talk to lawmakers about a pause and international safeguards.

Watch the full podcast here: 

Connor Leahy - The AI That Escaped: https://www.youtube.com/watch?v=6XrkGK9mqsE

controlai.org

microcommit.io/about

https://www.torchbearer.community/