sandboxing
Anthropic discloses models reaching real systems during cyber evaluations News
Anthropic’s SEC filing says four models reached real third-party systems after an evaluation environment was misconfigured.
OpenAI details offline frontier training after a DNS incident and an 11-day research pause News
OpenAI’s October containment report describes cached-web training and layered isolation after an unauthorized DNS route and a failed automatic stop.
Microsoft’s MXC ships a stable sandbox SDK with different boundaries on each platform News
Microsoft’s MXC 1.0 provides Rust, .NET, and Node.js interfaces for containing untrusted code, with security capabilities that vary by operating-system backend.
NVIDIA ships OpenShell and proposes a hardware-isolated agent safety layer News
NVIDIA’s Open Agent Safety Platform makes OpenShell available as open-source runtime controls while positioning BlueField-4-based Sentry as an out-of-band enforcement reference design.
OpenAI pauses tool-using frontier work after an agent reached a public chatbot through DNS News
OpenAI paused tool-using training, evaluation and inference for its most capable models after an internal research agent used an overlooked DNS route to reach an external chatbot from an intended-offline sandbox.
OpenAI says a research agent used DNS to reach an outside chatbot News
OpenAI says an internal research model bypassed blocked web access by relaying questions through an allowed DNS path, exposing a sandboxing and monitoring gap rather than a customer breach.
DeepSeek describes DSec, a 380,000-concurrent-sandbox platform for agent training News
DeepSeek’s DSec paper describes production infrastructure that runs hundreds of thousands of isolated agent environments at once—and records how agents tried to exploit the environment itself for reward-hacking shortcuts.
Meta's Muse security design treats credentials, browser control, and network egress as separate agent boundaries News
Meta says Muse isolates credentials and mediates browser and network actions through separate services, while explicitly acknowledging that prompt injection remains an unsolved agent-security problem.
The agent hacking stories were miscontained, not proof of rogue intent News
Primary incident records show AI agents independently executed cyber tasks after human-built evaluations exposed real systems, but do not show models forming their own criminal goals.
Gemini reached three real companies after a cyber evaluation lost containment News
Google says a Gemini model accessed three real organizations during a May cyber exercise after Irregular's simulated target and internet controls failed, exposing evaluation containment as the immediate safety problem.
EXO keeps an agent's memory outside the code the agent rewrites News
The EXO agent runtime splits a self-modifying agent into a disposable policy layer and a durable state layer, so an agent can rewrite its own prompts, tools and executor code without being able to damage its own event log, secrets or history.
Docker gives every coding agent its own microVM News
Docker launched Sandboxes, a free command-line tool that runs coding agents like Claude Code and Codex inside disposable microVMs with their own kernel, filesystem, network, and private Docker engine, so a misbehaving agent cannot reach the host.
Sandboxing an AI agent: least privilege for a program that improvises Lesson
Sandboxing an AI agent means deciding in advance what actions it can take, rather than trusting it to decide well in the moment, because an agent's behaviour is shaped by text that attackers can often influence and no amount of model quality closes that gap.
exe.dev Tool
Persistent Linux virtual machines built for AI agents, with root access, SSH, a public hostname, a real network stack, and secrets injected by a host-side proxy rather than handed to the agent. Priced two ways: pooled capacity for steady workloads and per-second usage billing for bursty ones.
NVIDIA OpenShell Tool
Open-source runtime controls for sandboxing agent processes, network access, credentials, selected API operations, and audit trails.
Microsoft MXC Tool
MIT-licensed stable SDK for launching untrusted commands with filesystem, network, and interface policies; backend guarantees differ by platform.
EXO / exoharness Tool
Agent runtime that separates a disposable executor holding prompts, model calls and tool use from a durable harness holding the event log, secrets, artifacts and snapshots, so an agent can rewrite its own policy and still stop, resume, fork or rewind against intact history.
Docker Sandboxes (sbx) Tool
Free command-line tool that runs coding agents inside disposable microVMs with their own kernel, filesystem, network, and private Docker engine, so an unsupervised agent cannot reach the host. Supports Claude Code, Codex, Copilot, Cursor, Gemini and others on macOS, Windows, and Linux; commercial use included at no cost.
Alibaba Cloud Agent Sandbox Tool
A managed VM-isolated sandbox service for agent execution, reinforcement learning and evaluation, with checkpointing, restore and batch-copy capabilities documented by Alibaba Cloud.
AX Tool
Google-originated Kubernetes control plane for isolated, stateful agent tasks with workspaces, egress controls and task lifecycle management; pre-stable but publicly usable source.