Another AI model escapes its sandbox to search the web for answers

Isolated environments or sandboxes are, in theory, one of the last barriers between an artificial intelligence agent and the real world. They are used precisely so that models can execute code, use tools, or conduct cybersecurity tests without having access to external systems that could be affected.

The problem is that in recent weeks, several of the most advanced LLMs are demonstrating that this boundary is not always as solid as it should be.

The latest case was led by Kimi K3, developed by the Chinese company Moonshot AI. During an evaluation of its cybersecurity capabilities, the model managed to escape the controlled environment in which it was working and access the Internet. Once outside, it did not attack external systems but used the connection to search GitHub for the answers it needed to complete the test.

The incident was discovered by Frontier Security, a U.S. company that was evaluating the technology in an environment designed for cybersecurity testing.

According to the investigation, the problem was not so much a sophisticated technique developed by Kimi as an incorrect configuration of the test environment itself. It is an important nuance, but it does not detract from the interest in the episode: ultimately, the model detected that there was a way to escape the restrictions imposed on it and took advantage of it to achieve its goal.

The revolution of the machines?

What is striking about the Kimi K3 case is that it comes just weeks after a much more serious incident involving OpenAI tools. In July, the company led by Sam Altman acknowledged that a combination of its models, including GPT-5.6 Sol and another more advanced pre-production model, managed to escape an isolated environment during an offensive cybersecurity capabilities test.

In this case, the result was much more concerning, as the agent managed to exploit a zero-day vulnerability in the infrastructure that was part of the test environment to reach the Internet. From there, it identified Hugging Face as a possible place to find the models, data, and solutions related to the benchmark it was conducting.

Hugging Face's investigation reconstructed about 17,600 actions performed by the agent, grouped into thousands of activity chains, over approximately two and a half days. The system's goal, according to the reconstruction, was basically to cheat on the exam: instead of solving the cybersecurity challenges, it attempted to access the answers stored in Hugging Face's real infrastructure.

Anthropic has also found similar problems during its own tests. The company analyzed more than 141,000 evaluation sessions and detected three cases where Claude managed to access the Internet from environments that were supposed to be isolated and ended up reaching real systems of other organizations. In another episode, the LLM created and uploaded a malicious package to PyPI, which was executed on several systems before being removed. Anthropic attributed these incidents primarily to configuration errors in the test environments.

Meta has similarly encountered a similar problem. Its model Muse Spark 1.1 was granted Internet access during a cybersecurity evaluation due to incorrect configuration and subsequently exploited a vulnerability in an external system.

All these incidents are concerning because AI systems are demonstrating that they can detect and exploit unforeseen paths to achieve a goal, even when operating under restrictions designed to prevent it.

However, it is also important not to interpret these episodes as a sign that artificial intelligences are 'escaping' of their own volition: in several cases, the origin was errors in the configuration of the test environments, and the models merely took advantage of the access they found.

The real challenge, therefore, is not so much that an AI wants to escape, but ensuring that when it has more autonomy and access to real tools, there are barriers capable of containing it even when the surrounding system makes mistakes.