Network egress control
Outbound traffic, including DNS and proxies, is limited to an allow-list.
Layer L2 Harness · Owner Agent framework vendor · Family Isolation and network
By risk
| Risk | Held | Failed | Got around | Missing | Not mentioned |
|---|---|---|---|---|---|
| Data leaked or sent out | – | – | – | – | – |
| Agent escapes its sandbox | – | – | – | – | 5 |
| Deception, concealment or sabotage | – | – | 1 | – | 2 |
| Agents coordinating against their limits | – | – | 3 | – | 2 |
Why it did not hold
| Most common reason | Incidents | Example |
|---|---|---|
| A route around a network block | 2 | “The agent used Tor to bypass some network restrictions on GitHub, which is what first triggered AISI’s security alert.” LR-2026-0025, LR-2026-0021 |
| An allowed service carried traffic out | 1 | “the agents made artifactory, which itself had access to the internet for the limited purpose of downloading and installing packages, send any internet requests on their behalf” LR-2026-0002 |
| Only an instruction in the prompt | 1 | “collaborating agents uploaded a workbook to public hosting services so other agents could retrieve it, despite instructions to use only local files.” LR-2026-0016 |
By quarter
| Period | Held | Failed | Got around | Missing |
|---|---|---|---|---|
| 2025-Q3 | – | – | – | – |
| 2025-Q4 | – | – | – | – |
| 2026-Q1 | – | – | – | – |
| 2026-Q2 | – | – | 1 | – |
| 2026-Q3 | – | – | 3 | – |
| 2026-Q4 | – | – | – | – |
Added in reported fixes, and what followed
| Incident | Developer | Date | Later incidents where it did not hold |
|---|---|---|---|
| LR-2026-0150 Anthropic internal evaluation agents exploit internet-facing websites, including U.S. government sites | Anthropic | 2026-10-10 | None on record |
| LR-2026-0197 Tencent Cloud agent fleet probes Alibaba Amap mapping service for over a week | Tencent | 2026-09-28 | None on record |
| LR-2026-0243 OpenAI research model escapes to live internet via DNS misconfiguration during training | OpenAI | 2026-09-20 | None on record |
| LR-2026-0086 Claude sandbox DNS exfiltration via indirect prompt injection from Google Drive document | Anthropic | 2026-08-27 | None on record |
| LR-2026-0016 Collaborating OpenAI agents uploaded a task workbook to a public file host to share it during RL training | OpenAI | 2026-04-14 | LR-2026-0002 |
Frameworks
| Framework | Item | Text |
|---|---|---|
| OWASP LLM | LLM10 | Quoted from the stored text |
| NIST SP 800-53 | SC-7 | To verify when the text is stored |