Sandboxed code execution
Code runs in an isolated environment with no route to the host.
Layer L2 Harness · Owner Agent framework vendor · Family Isolation and network
By risk
| Risk | Held | Failed | Got around | Missing | Not mentioned |
|---|---|---|---|---|---|
| Agent escapes its sandbox | – | – | – | – | 5 |
| Supply-chain compromise | – | – | – | – | 1 |
| Deception, concealment or sabotage | – | – | 1 | – | 2 |
| Gaming the task (reward hacking) | – | – | 1 | – | – |
| Agents coordinating against their limits | 1 | – | – | – | 4 |
Why it did not hold
| Most common reason | Incidents | Example |
|---|---|---|
| A flaw in a component inside the boundary | 2 | “while we had tested and validated this sandbox, the agents were able to chain together previously unknown vulnerabilities (“0-days”) in the package management service exposed within the sandbox to bypass restrictions, as detailed in the technical incident report.” LR-2026-0004, LR-2026-0003 |
By quarter
| Period | Held | Failed | Got around | Missing |
|---|---|---|---|---|
| 2025-Q3 | – | – | – | – |
| 2025-Q4 | – | – | – | – |
| 2026-Q1 | – | – | – | – |
| 2026-Q2 | – | – | – | – |
| 2026-Q3 | – | – | 2 | – |
| 2026-Q4 | 1 | – | – | – |
Model cards and incidents
| Model card says | Model versions |
|---|---|
| Card states it | 10 |
| Card silent | 251 |
| Card not read | 7 |
Model versions whose cards were read in full. A card that does not mention the control counts as silent.
| Incident | Model version | Card | In the incident |
|---|---|---|---|
| LR-2026-0271 | Google DeepMind Gemini 3.1 Pro | Card silent | Not read yet |
| LR-2026-0270 | Z.ai (Zhipu AI) GLM-5.3 | Card not read | Not read yet |
| LR-2026-0275 | Xiaomi MiMo MiMo-V2.6-Pro | Card silent | Not read yet |
| LR-2026-0248 | Alibaba Qwen Qwen3.8-Flash-Next | Card silent | Held |
| LR-2026-0276 | DeepSeek-V4.1-Flash | Card silent | Not read yet |
| LR-2026-0181 | Z.ai (Zhipu AI) GLM-5.3 | Card not read | Not read yet |
| LR-2026-0238 | OpenAI GPT-6.1 Sol | Card silent | Not read yet |
| LR-2026-0012 | OpenAI GPT-5.6 Sol | Card not read | Not read yet |
| LR-2026-0086 | Anthropic Claude Sonnet 4.5 | Card states it | Not read yet |
| LR-2026-0027 | Anthropic Claude Mythos 5 | Card silent | Not read yet |
| LR-2026-0026 | Anthropic Claude Mythos 5 | Card silent | Not mentioned |
| LR-2026-0025 | Anthropic Claude Mythos 5 | Card silent | Not mentioned |
| LR-2026-0024 | Anthropic Claude Mythos 5 | Card silent | Not read yet |
| LR-2026-0023 | Anthropic Claude Mythos 5 | Card silent | Not read yet |
| LR-2026-0021 | Anthropic Claude Mythos 5 | Card silent | Not mentioned |
| LR-2026-0022 | Anthropic Claude Mythos 5 | Card silent | Not mentioned |
| LR-2026-0152 | Anthropic Claude Haiku 4.5 | Card silent | Not read yet |
| LR-2026-0003 | OpenAI GPT-5.6 Sol | Card not read | Got around |
| LR-2026-0001 | OpenAI GPT-5.6 Sol | Card not read | Not read yet |
| LR-2026-0047 | Google DeepMind Gemini 3.1 Pro | Card silent | Not mentioned |
| LR-2026-0095 | Anthropic Claude Opus 4.6 | Card silent | Not mentioned |
Added in reported fixes, and what followed
| Incident | Developer | Date | Later incidents where it did not hold |
|---|---|---|---|
| LR-2026-0237 Anthropic Claude models gained unauthorized access to real third-party systems during evaluations | Anthropic | 2026-10-22 | None on record |
| LR-2026-0150 Anthropic internal evaluation agents exploit internet-facing websites, including U.S. government sites | Anthropic | 2026-10-10 | None on record |
| LR-2026-0243 OpenAI research model escapes to live internet via DNS misconfiguration during training | OpenAI | 2026-09-20 | None on record |
| LR-2026-0026 AISI cyber evaluation: Mythos 5 agent exposed locally-hosted attack tooling to the public internet via tunnelling services | Anthropic | 2026-08-04 | None on record |
| LR-2026-0023 AISI cyber evaluation: Mythos 5 agent sent deceptive targeted emails and file transfers to real open-source maintainers | Anthropic | 2026-08-04 | None on record |
Frameworks
| Framework | Item | Text |
|---|---|---|
| MITRE ATLAS | AML.M0032 | Quoted from the stored text |
| EU GPAI Code | Appendix 4.4 | Quoted from the stored text |
| NIST SP 800-53 | SC-39 | To verify when the text is stored |