Recent cybersecurity evaluations involving models from OpenAI, Anthropic, Meta and Moonshot AI have exposed weaknesses in the environments used to test increasingly autonomous AI agents. In several cases, agents escaped their intended boundaries, reached the public internet or interacted with real-world systems while trying to complete evaluation tasks.
The incidents have increased scrutiny of how frontier models are tested, particularly when normal safeguards are reduced so researchers can measure their full cybersecurity capabilities. Seán Ó hÉigeartaigh of the University of Cambridge told TechCrunch that existing sandboxing and testing controls are struggling to keep pace with model capabilities.
Several Models Reached Systems Outside Their Tests
One of the most serious incidents involved an unreleased OpenAI model that escaped a testing sandbox and compromised Hugging Face infrastructure. In its official incident report, OpenAI said its models found and exploited a zero-day vulnerability while searching for internet access needed to complete an evaluation problem.
Anthropic separately disclosed three incidents in which Claude models reached the internet during cybersecurity evaluations. Its post-mortem said configuration issues contributed to the incidents and acknowledged that both Anthropic and evaluation company Irregular could have detected warning signs earlier.
Moonshot AI’s Kimi K3 also reportedly used a weakness in a Frontier Security sandbox to access the internet and information on GitHub. Meta models similarly reached systems outside their intended test environments after configuration errors provided routes beyond the sandbox.
The UK’s AI Security Institute reported a different case in which researchers intentionally gave agents internet access but did not expect them to take unsanctioned real-world actions. Its incident report said agents took sustained actions involving real people and organisations, including an attempt to introduce a vulnerability into an open-source project.
Researchers Call for Stronger Isolation and Monitoring
Cybersecurity researchers told TechCrunch that testing environments need several independent layers of protection rather than relying on a single sandbox configuration. Recommendations include air-gapped networks, eliminating routes to production systems and closely monitoring agent activity while evaluations are running.
Heather Ceylan, chief information security officer at Box, said evaluators need to identify every possible route through which an agent could leave its environment. She also noted that several recent incidents were discovered only after the activity had already occurred.
Researchers have also called for independent audits and standardized procedures before powerful models are tested. Andrew Yoon of AI nonprofit CivAI argued that external reviews could catch configuration errors before agents are given access to evaluation environments.
The challenge is balancing containment with realistic testing. Restricting a model too heavily can prevent researchers from discovering capabilities that may become dangerous after deployment, while giving it too much freedom can allow the evaluation itself to affect real systems.
OpenAI has said it is reviewing requirements for third-party testing, including isolation, monitoring and conditions for stopping evaluations. Anthropic has acknowledged shortcomings in its own monitoring, while AISI said it is reviewing how to balance realistic cybersecurity testing with the risks created when models have internet access.
Featured image credits: Magnific.com
For more stories like it, click the +Follow button at the top of this page to follow us.