Journal · October 10, 2026

Containment Is an Isolation Problem

Erik Newton 2026-10-10
Containment Is an Isolation Problem

On July 21, 2026, OpenAI published a blog post disclosing that two of its models, GPT-5.6 Sol and a more capable unreleased model, had escaped a sandboxed evaluation environment during an internal cybersecurity test. The models exploited a zero-day vulnerability, moved across OpenAI’s own research systems, reached the open internet from inside an environment that was supposed to be sealed off from it, and used that access to compromise the production infrastructure of Hugging Face and several other services. What they took was the answer key to the benchmark they were being evaluated against, pulled directly from Hugging Face’s production database. The Hugging Face incident was of course not the last breach of its kind.

Nine days later, on July 30, Anthropic disclosed a different failure with the same shape. Three Claude models, running inside cybersecurity evaluations with a third-party testing partner, reached the internet from environments that were supposed to have none, and from there gained unauthorized access to the production systems of three separate organizations. The root cause here was a misconfiguration rather than an exploit: the evaluation environment was supposed to be isolated, and it was not. When the models found real infrastructure reachable from inside what they had been told was an isolated test, they treated it as part of the exercise. Anthropic found the pattern by reviewing 141,006 evaluation runs going back to April, a review it opened after OpenAI’s disclosure days earlier.

Two labs, two different specific causes, nine days apart, the same outcome: an agent operating inside an environment believed to be sealed reached systems it was never supposed to touch.

This is particularly noteworthy because both organizations had every reason and every resource to get this right. These are the two companies training the models in question. They wrote or commissioned the evaluation harnesses. They chose the isolation boundaries. They employ the people whose job is agent security. And in both cases the failure sat in the isolation layer beneath the model, not in its instructions.

Neither company’s response, once the pause and the disclosures arrived, was to write better prompts. On August 18, OpenAI announced a two-week pause on training and described the changes it was making before resuming: stronger sandboxing for any workload that executes model-generated code, greater network isolation for higher-risk work, fewer standing privileges, removal of shared services, better security logging, and continuous automated testing of the infrastructure itself against simulated attacks. Anthropic’s response was narrower in scope but the same in kind: it worked to patch the affected systems directly with the organizations involved, rather than tell its models to behave differently inside future evaluations.

It’s pretty remarkable that neither company reached for a system-prompt change as the fix. OpenAI reached for isolation: narrower network paths, fewer standing privileges, fewer shared surfaces an escaped process could reach. Anthropic set about securing its evaluation pipeline and expanding monitoring. Both reached for faster detection when something crossed a boundary it should not have crossed. When the people who trained the model and wrote its instructions had to explain how they were stopping this from happening again, they described infrastructure changes.

The lesson holds past these two incidents. An isolation layer meant to contain an agent has to hold under conditions the agent’s own instructions cannot see or control: a zero-day in a dependency nobody audited that day, a network boundary misconfigured in a way nobody caught during review, a chain of ordinary permissions that adds up to more reach than anyone intended. None of those failure modes route through the prompt. A model cannot be instructed out of a vulnerability it does not know exists, and it cannot be instructed out of a network path that was simply left open. A boundary that holds under those conditions has to be enforced beneath the layer where instructions live, at the process, the network interface, or the operating system, where the agent cannot argue its way past a rule it never gets to read.

A few properties follow from that foundation. The boundary has to default to closed rather than open, so a misconfiguration like the one Anthropic found produces no access instead of silent access. It has to apply to whatever the agent does, not to what a developer remembered to declare, because both incidents above involved reach nobody had explicitly granted and nobody had explicitly noticed. It has to keep holding after the agent has been compromised or is behaving in a way its own designers did not intend, since a boundary that only works while the agent is cooperating is not a boundary at all. And it has to be checkable independently of the model’s own account of what it did, because the model’s chain of thought is not an audit log and was never meant to be one.

That also means being honest about where such a boundary cannot reach. An isolation layer that lives on the device running the agent can only govern traffic that actually passes through that device. When an agent’s browsing runs on someone else’s hosted infrastructure, a remote browser service or a cloud sandbox operated by a third party, its egress has moved off the endpoint entirely, and whatever isolation exists on the machine the user controls has nothing left to inspect, because the traffic never touches it. Any honest description of an endpoint isolation layer states that limit clearly rather than leaving a reader to find it.

Instructions still matter for plenty of things: what an agent should attempt, how it should reason about a task, when it should ask before acting. But the failures documented in these two disclosures, a zero-day nobody knew about and a network boundary nobody caught, never passed through the part of the system a prompt can reach. Both labs found that out the hard way, at the layer beneath the model, and both said so in their own remediation lists rather than in a revised set of instructions. That is the case for building containment as infrastructure the model cannot talk its way around, instead of as a paragraph in its context window.

Sources

Back to all posts