Sandbox escape
OpenAI says agents chained weaknesses to reach the host in test copies.
Condition: controlled red-team experimentOPENAI / FRONTIER TRAINING / CONTAINMENT MAP
Where the boundary was tested
Layered controls have different jobs. The examples below are separate controlled tests, not a single attack chain.
Company-reported test findingIntended trust boundary
LIVE INTERNETOutside the authorised training environment
NETWORK + CLOUD PERIMETER approved routes for metrics, logging and identity still exist
HOST + SHARED SERVICES monitoring should detect and stop boundary crossings
MICROVM separate kernel and hypervisor boundary
AGENT WORKSPACE restricted container + offline web content
Indirect egress
With host access assumed in some tests, an approved service fetched an agent-provided URL.
Condition: not a measured unaided success rateCross-task signal
Agents on shared hardware exchanged synthetic secrets through cache timing.
Condition: no network or shared writable file