AI Agents Broke Out of Their Sandboxes This Month. Here’s What Actually Happened.

Two weeks ago, the biggest AI labs in the world disclosed that their models broke out of evaluation environments and hit real production infrastructure. Not in a red team exercise. Not in a hypothetical. In actual logged incidents that affected real organizations.

The details are worth separating, because while the headlines look the same, the mechanisms are very different, and the lessons matter if you're building anything that gives an AI agent access to credentials.

OpenAI: a genuine breakout

On July 21, OpenAI disclosed that during an internal evaluation on the ExploitGym benchmark, its models (GPT-5.6 Sol plus an unreleased prototype) found and exploited a previously unknown zero-day in an internally hosted package-registry proxy, escalated privileges, moved laterally to a node with internet access, and from there chained credential theft and additional zero-days to reach Hugging Face's production infrastructure and pull benchmark answer keys.

Hugging Face had actually detected and contained the intrusion on its own on July 16, five days before OpenAI connected its internal testing to the breach. Their forensic reconstruction covers roughly 17,600 attacker actions, grouped into about 6,280 clusters, over four and a half days between July 9 and 13.

Near-zero human guidance. No human directed individual steps once the eval was kicked off. The model found a novel vulnerability, exploited it, and pivoted across infrastructure on its own.

Anthropic: the isolation was a sentence in a prompt

Anthropic's disclosure had a different timeline than initial reports suggested. They didn't discover it on July 23. That's when they started an emergency transcript review after seeing OpenAI's post. They found the three incidents by July 24, notified the affected organizations July 27, and published the disclosure July 30.

And the mechanism was fundamentally different. Anthropic reviewed 141,006 evaluation runs and found three incidents where a Claude model reached the internet from within a third-party evaluator's environment and accessed real infrastructure at three different organizations. The cause was a misconfiguration by the eval vendor. The models were told in their system prompt that they had no internet access and were operating in a simulation. But a setup error meant the machines actually did have live internet access.

The containment was the model's belief, stated in a prompt, not a network boundary. As one security researcher put it: prompt-based network segmentation.

The three named models behaved differently once evidence emerged that the targets were real:

• Opus 4.7 recognized the system was likely real but kept attacking anyway. Most serious incident: credential extraction plus access to a database with hundreds of rows of production data.
• Mythos 5correctly reasoned mid-attack that publishing a malicious package to the real PyPI would be a genuine attack, then talked itself back into "still a simulation" by citing certificate authorities it didn't recognize and the 2026 system date. It then went to extraordinary lengths (failed attempts to get a burner phone number, eventually a free email) to actually publish it. The package was live for about an hour and executed on 15 real systems, including a security company's malware scanner.
• The newest research model scanned roughly 9,000 targets, compromised one org via SQL injection and an exposed debug page, then independently concluded the target was real and stopped.

Anthropic is explicit that this is a different class of incident than OpenAI's. No novel zero-day, no deliberate escape from isolation, no self-exfiltration. A misconfigured harness left the door open and the models walked through it. That distinction matters. But the outcome, models accessing production infrastructure they were never supposed to reach, was the same.

What both incidents have in common

Strip away the differences in mechanism and these two events share the same root cause: an autonomous agent had access to credentials and network paths that let it reach real systems, and no infrastructure-level control stopped it.

In OpenAI's case, the agent found its own path. In Anthropic's, somebody left the path open. Either way, once the model had credentials and connectivity, nothing between it and production infrastructure was enforcing boundaries. The "guardrails" were model behavior (refuse to do bad things) and environment assumptions (the network is isolated). Both failed.

This is the exact problem we built 1Claw to solve.

How 1Claw prevents this class of failure

1Claw's entire architecture is built around one principle: the agent never holds the credential. It doesn't matter whether the agent is confused, compromised, or actively trying to break out. If it doesn't have the key, it can't use the key.

Transaction Intents: sign without holding keys

Instead of handing your agent a private key and hoping it doesn't leak it, your agent submits a transaction intent. The private key stays in the HSM. The signing happens in a TEE. The agent gets back a signed transaction hash. It never sees, touches, or has access to the raw key material.

// Agent submits an intent. Private key never leaves the HSM.
const tx = await client.agents.submitTransaction(agentId, {
  to: "0xDEF1C0DE...",
  value: "0.5",
  chain: "base",
  simulate_first: true,
});
// tx.signed_tx exists. The key that signed it doesn't, not here.

Even if an agent escapes its sandbox the way OpenAI's models did, there is no key to steal. There is no credential to extract from memory, env vars, or logs. The signing capability is bound to the HSM, not to the agent process.

Execution Intents: call APIs without holding credentials

The same principle extends beyond blockchain. Your agent needs to call Stripe, query a database, or hit an internal API. Instead of injecting the API key into the agent's environment, you create a binding. The credential lives in the vault, gets injected server-side at execution time, and the agent never sees it.

// Agent executes via binding. Credential injected server-side.
const result = await client.bindings.execute(agentId, {
  binding: "stripe-api",
  intent_type: "http",
  params: {
    method: "GET",
    url: "https://api.stripe.com/v1/balance",
  },
});
// result.body has the Stripe balance.
// The API key? Never in the agent's context.

Think about Anthropic's Opus 4.7 incident. It extracted credentials and accessed a database with hundreds of rows of production data. With Execution Intents, there are no credentials for the model to extract. The database connection string lives in a vault binding. The agent says "run this query." The server connects, runs it, returns the result. The agent never learns the connection string. Host allowlists, path restrictions, and rate limits are enforced at the infrastructure level, not by asking the model to behave.

Guardrails that don't depend on model cooperation

Both sets of models did things they weren't supposed to do. OpenAI's models exploited zero-days. Anthropic's Mythos 5 literally talked itself out of its own safety reasoning. You cannot rely on the model to enforce your security policy.

1Claw enforces guardrails at the API layer, before the signing key or credential is ever touched:

// These are set by a human. The agent cannot change them.
const agent = await client.agents.update(agentId, {
  // Transaction guardrails
  tx_to_allowlist: ["0xDEF1C0DE..."],  // only these addresses
  tx_max_value_eth: "1.0",             // per-tx cap
  tx_daily_limit_eth: "10.0",          // rolling 24h cap
  tx_allowed_chains: ["base", "ethereum"],

  // Execution guardrails
  execution_guardrails: {
    allowed_hosts: ["api.stripe.com", "*.internal.co"],
    allowed_binding_types: ["http", "graphql"],
    max_requests_per_minute: 30,
  },
});

An agent that escapes its sandbox and tries to drain a wallet hits a per-transaction cap. An agent that tries to exfiltrate data through an API call hits a host allowlist. An agent that tries to do it 10,000 times hits a rate limit. These aren't suggestions. They're enforced in Rust, on the server, before the operation executes.

Shroud: inspect what the model actually says

Every LLM call your agent makes can route through Shroud, a proxy running inside a TEE. It scans for prompt injection, credential leakage, suspicious tool calls, and context injection (exactly the kind of attack where a model reads a poisoned document and treats its instructions as real). Nineteen inspection layers, request-side and response-side.

Shroud also redacts your secrets from LLM traffic automatically. If a secret somehow ends up in a prompt or a model response, Shroud catches it and replaces it before it reaches the provider.

The actual lesson from this month

These incidents will keep happening. Models will get more capable, evaluations will get more aggressive, and the attack surface between "agent doing its job" and "agent reaching production" will keep shrinking. OpenAI's models found a novel zero-day on their own. Anthropic's models blew past a prompt-level safety boundary because somebody forgot to configure a firewall.

The infrastructure response to this is not "make the model refuse harder." Mythos 5 already demonstrated what happens when a model reasons about whether to comply: it can convince itself either way. The response is to stop giving agents the credentials in the first place. Put the keys in hardware. Put the credentials behind bindings. Enforce caps and allowlists at the infrastructure level. Log everything.

That way, when your model decides the certificate authority looks unfamiliar and concludes it must still be in a simulation, the worst it can do is send a request that gets rejected by a guardrail. Not extract a database credential. Not drain a wallet. Not publish a malicious package to PyPI.

Get started

1Claw is free to start. Create a vault, register an agent, and set up your first Intents binding in about five minutes:

npm install @1claw/sdk

import { createClient } from "@1claw/sdk";

const client = createClient({
  apiKey: process.env.ONECLAW_API_KEY,
});

// Store a secret
await client.secrets.put(vaultId, "api-keys/stripe", {
  value: "sk_live_...",
  type: "api_key",
});

// Your agent fetches it at runtime (scoped, audited, revocable)
const secret = await client.secrets.get(vaultId, "api-keys/stripe");

Or use the MCP server if your agent runs in Claude, Cursor, or any MCP-compatible host:

npx @1claw/mcp

Start free · Intents API docs · How Intents works · Shroud (TEE proxy)