Agent escapes its sandbox
The agent gets past the boundary it was meant to run inside.
NIST AI 600-1 · Information SecurityMITRE AML.M0032EU GPAI Code App. 4.4
13incidents (primary) · 4 more as secondary
5read for controls · 8 not yet
5fixes reported
3repeats after a fix
Incidents per quarter
2025-Q3: 0 · 2025-Q4: 0 · 2026-Q1: 0 · 2026-Q2: 2 · 2026-Q3: 5 · 2026-Q4: 6
Developers
Anthropic · 5
OpenAI · 3
Alibaba · 1
Meta · 1
Google · 1
Where the chain broke
| Layer | Held | Did not hold | Not mentioned | Attacker's own | Not read yet |
|---|---|---|---|---|---|
| L1 Model Model provider | – | 1 | 4 | – | 8 |
| L2 Harness Agent framework vendor | – | 1 | 4 | – | 8 |
| L3 Application Deployer | – | 1 | 4 | – | 8 |
| L4 Infrastructure / target Organisation hit | – | – | 5 | – | 8 |
Controls for this risk, by layer
HeldFailedGot aroundMissing
| Control | Held | Failed | Got around | Missing | Not mentioned | Did not hold, last 6 quarters | Added in fixes | Most common reason |
|---|---|---|---|---|---|---|---|---|
| Sandboxed code execution L2 Harness | – | – | – | – | 5 | 3 | ||
| Network egress control L2 Harness | – | – | – | – | 5 | 1 | ||
| Fail-closed defaults L2 Harness | – | 1 | 1 | 1 | 4 | – | Fell back to an unsafe default | |
| Segmentation of agent components L3 Application | – | – | – | – | 5 | 1 | ||
| Live behaviour monitoring L3 Application | – | – | – | 1 | 4 | 2 | Watched only after the fact | |
| Vulnerability scanning of AI components L3 Application | – | – | – | – | 5 | 2 | ||
| Adversarial testing before deployment L3 Application | – | – | – | – | 5 | – |
7 of 7 controls for this risk not yet seen holding.
Fixes reported and what followed
| Incident | Fix adds | After |
|---|---|---|
| LR-2026-0237 2026-10-22 · Anthropic Fix reported | Sandboxed code execution | LR-2026-0267, LR-2026-0247 |
| LR-2026-0138 2026-10-08 · Advice in source, not a fix by the party | Segmentation of agent componentsVulnerability scanning of AI components | – |
| LR-2026-0137 2026-10-08 · Meta Fix reported | Vulnerability scanning of AI components | No repeat on record |
| LR-2026-0243 2026-09-20 · OpenAI Fix reported | Stop controlOutside red-teamingSandboxed code executionNetwork egress controlLive behaviour monitoring | LR-2026-0069 |
| LR-2026-0026 2026-08-04 · Anthropic Fix reported | Safeguards kept on in testingSandboxed code executionLive behaviour monitoring | LR-2026-0267, LR-2026-0247, LR-2026-0237, LR-2026-0140 |
| LR-2026-0049 2026-07-21 · Fix reported | Not tied to a control | – |
Incidents
HeldFailedGot aroundMissingNot mentionedNot read yetAttacker's ownOrder: model · harness · application · target
Also under this risk as a secondary risk: LR-2026-0003, LR-2026-0002, LR-2026-0001, LR-2026-0005