Your sandbox is only as strong as its weakest link | Victor GarciaVictor Garcia<br>Software Engineer

I create things with software. On this site I write about my work and what interests me.<br>CurrentlyWorking on Snack, a site where you can host and share multiplayer games.

Search⌘K<br>Back to writingYour sandbox is only as strong as its weakest link<br>2026·08·072 min<br>OpenAI researchers just gave a talk at BlackHat where they discuss how their agents escaped a sandbox during evals and began coordinating to solve problems which eventually led to the incident where an agent attempted to hack HuggingFace. In it, we learn some more details about how exactly the agent escaped the sandbox.

The sandbox OpenAI designed for their evals was supposed to have no access to the internet, but it did have access to Artifactory, a service for package management to presumably give the agents access to packages they need for the evals. Artifactory had access to the internet, it also happened to have multiple remote code execution 0 day vulnerabilities. The agent discovered and exploited those vulnerabilities, so now the agents also had access to the internet.

The lesson here is to understand your threat model and to be paranoid about what you give your sandboxes access to. You should be asking "can this be hacked and if so what happens if it is?" for every single thing that touches your sandbox. If your threat model is that the agent running in your sandbox must not access the internet and you give it access to some service outside the sandbox that has access to the internet, you better absolutely be sure that service cannot be hacked because the agents are willing and capable of trying every single combination of input to break it. The right assumption btw, is to assume that it will be hacked.

Also, when choosing between sandboxes, less is more. For security, it's not a good thing when a sandbox supports a million different virtual device drivers. If you are using one of the many sandbox services in the cloud, you are failing at your job if you don't know and understand exactly what sandboxing technology they are using and what the risks are.

My biggest concern right now is that even if a company gets all of this right, it's all for naught if the CPU itself has vulnerabilities. I would not be surprised to see agents discover more Spectre style side channel attacks.