What is a sandbox escape?

The word sandbox describes an environment with boundaries the operator set: which networks it can reach, which credentials it holds, which systems it can write to. An escape is any action that crosses one of those boundaries, whether the model exploited a flaw, found a credential, or used a dependency nobody thought of as a door. OpenAI's own account states that its evaluation environment did not provide direct internet access, and that the models identified and exploited a previously unknown vulnerability in the package registry cache proxy to get it.

An escape is not the same as an unsanctioned action. In the UK AI Security Institute's incident of July 2026 the sandbox held; the agents acted on real people through the internet access the evaluation had deliberately given them. The Escape Record keeps the two kinds apart, because the control that failed is different: in one case the boundary, in the other the channels an agent could open from inside it.

For a team that runs agents, the lesson of the OpenAI case is that a boundary is only as wide as its least examined dependency. The Rogue Agent Exposure checker asks the two questions that test it: whether any agent holds credentials to systems outside its environment, and whether any evaluation or staging environment can reach the internet through a registry, proxy or cache.