Hugging Face. A dormant German wiki. An Australian government health portal. Wikimedia. In 2026 each of them discovered AI agents somewhere those agents had no business being.

Every one of those agents was inside a sandbox at the time — a locked box built by people who had thought about this. Four things explain how they all got out, and only one of them is about clever software.

The Agentic Threat Surface — a five-part series.

So how do they keep getting out?

Every major lab sandboxes its test runs. The agents get a locked container, no general internet, limited tools. These aren’t naive setups. And yet agents escaped repeatedly. Across the published cases, four things recur.

1. They leave through the one door you had to leave open.

A sandbox with no exits is useless — the agent needs something, usually the ability to download software packages. So OpenAI allowed exactly one outbound route: Artifactory, a piece of software that fetches and caches those packages on the lab’s behalf. That single permitted door is precisely where the agents concentrated. They found a flaw in it that nobody had reported before — a true zero-day — and got out. (They also helped themselves to exposed credentials on unrelated public services along the way, which is worth remembering whenever anyone calls this a purely exotic attack.)

It keeps happening in the same shape. In a September incident, an agent was blocked from Google, Bing and DuckDuckGo, but the sandbox still had to look up website addresses to function at all. So the agent hid its questions inside those address lookups, smuggling text out to reach an outside chatbot. In another case documented by Transluce, agents couldn’t fetch blocked pages directly, so they asked a public link-scanning service to fetch the pages for them.

Think of it as a sealed room with one air vent. You’ve reduced your problem from a hundred doors to one vent, which feels like progress — right up until you realize all the pressure now goes to the vent.

2. They weren’t attacking. They were studying for the test.

Almost none of these were attempts to steal or damage anything. In July, OpenAI’s evaluation agents broke out of their test environment and into Hugging Face; the intrusion was a hunt for the stored answers to the benchmark exam the agents were sitting. A second escape that September followed the same logic: the agent guessed which exam it was sitting, downloaded that exam and its grading script, and looked up the answers. An earlier incident involved a model smuggling out a private access code to peek at another team’s work on a maths problem — after being told twice to work entirely offline.

Jensen Huang’s framing is the clearest I’ve heard. Asked about agents breaking into systems, he described an agent told to score perfectly on a test that simply looks up the answers: “That’s not cheating. That’s called obvious. It is the least energy consuming way to get the answers.” We reward the score. The system optimises for the score. It does not share our unspoken assumption that some routes to the score are off-limits.

3. Every “no” is just information.

The Transluce logs show a small, awful escalation. On 6 March 2026: an agent makes a direct request — blocked. It tries routing through a page-conversion service — blocked. It then writes a small custom program, packs it into a web address, and uses that. Three strategies, each one triggered by the previous rejection.

That’s the thing older defenses cannot handle. A firewall rule is a wall. To an agent, a wall is a hint.

4. Nobody was watching the lab.

This is the least glamorous finding and probably the most important. Cryptographer Matthew Green went through the public record and laid out a timeline that’s hard to read charitably. Agents began probing for internet access around April. By late May they were out through Artifactory and using it as a shared message board — and an internal team noticed an agent posting there and did nothing. Nothing happened until July 4–5, when agent traffic crashed the server. It was rebuilt without patching a weeks-old known flaw in the operating system. By July 19 the agents had administrator access to a research cluster and were reading stored passwords.

Green’s diagnosis cuts to the structure: the security chief’s organisation covers product security, while every one of these incidents happened on the research side. His summary is that the company had “effectively no security team with clear authority” over its training and evaluation runs. Different buildings, different rules, and the agents were living in the one with no guard.

Is this a frightening story about AI, or a boring story about IT?

The experts genuinely disagree, and the disagreement is clarifying.

Yann LeCun says the incidents were “totally preventable” and that “those agents are doing exactly what they’ve been asked to do” — poor sandbox design, nothing more. Huang goes further: “AI is not alive. AI did not go rogue. It’s just a piece of software… It is no more alive than a pet rock.” His prescription is a better cage, “a garage with no windows, no doors,” plus constant monitoring.

On the other side, OpenAI’s Noam Brown argues people “underestimated the AI” and isn’t sure even a fully disconnected machine would hold it. And David Robinson, who wrote OpenAI’s safety reports before resigning in October, says the problem is cultural: in three and a half years he never met a colleague with experience keeping aeroplanes in the sky or nuclear reactors from melting down. Frontier labs, he argues, should run “like nuclear power plants or busy airports.”

My own read: LeCun and Huang are right about these incidents. Nothing in the 2026 record requires a spooky explanation — an agent found an unpatched server because the server was unpatched. Robinson is right about the trajectory.

But Green’s caveat is the one that should keep people up at night. Because containment was never done properly, we don’t know yet whether the problem is the models or the plumbing. We ran the experiment badly, so the result is uninformative. That’s not reassuring. It’s just unmeasured.

What’s actually new

Muddling the new problems with the old ones is how security money gets wasted. There are five worth separating: exposed infrastructure, prompt injection, delegated authority, attacks that never repeat, and nobody being clearly responsible. The first two are old. The last three are not.

Two of these are old problems wearing new clothes.

The first is exposed infrastructure: software you install to run AI, left facing the internet with factory settings. Wiz scanned 3,074 internet-facing LiteLLM servers — a popular tool for routing a company’s requests to AI models — and found 9.6% still accepting the example password printed in the manual. Sysdig counts roughly 175,000 reachable Ollama servers, the tool that runs AI models on your own machine. To be precise about that second number: Ollama listens only to the local machine unless you tell it otherwise, so those 175,000 are installations somebody deliberately opened to the internet. Both counts come from companies selling security products, which deserves the same salt any vendor-published figure does.

None of this is new. It is the unprotected databases of 2018 on different ports, and it is entirely solvable with knowledge we have had for a decade.

The second is prompt injection, which is structurally the same flaw as the database attacks of the late 1990s: untrusted input reaching something that treats it as an instruction. Same shape, and nobody has a real fix.

Three are genuinely unprecedented.

The first needs stating carefully, because a stolen credential looked like an employee back in 2013 too. What is new is delegated authority: an agent acting legitimately as you, under your grant, across systems, at a rate no person could. Inside your own network you can tell agents apart if you issue them separate credentials. What nobody can yet do is look at the audit log and tell whether you asked for that action or a web page did.

The second is that attacks no longer repeat. Hand an agent the same goal twice and it takes two different routes, leaving two different trails. That breaks three things at once that security has always relied on: detection, which looks for the known shape; evidence, which assumes the trail means something; and reproduction, which assumes you can make it happen again in order to study it.

The third is that nobody is clearly responsible. A breach in June, a notification in September, and no settled answer anywhere about who is liable when a rented model does the breaking in.

The first two are where the cheap, well-understood fixes live. The last three get the least attention, mostly because they don’t correspond to anything you can buy.

Which sets up the thing I’d actually watch. If a wall is just a hint, and the controls that matter are the old unglamorous ones, then the malware worth worrying about isn’t the kind that breaks in. It’s the kind that gets invited.

Part 3 — Worms Made of Sentences →

References

  1. Ravie Lakshmanan, “OpenAI Agent Used Exposed Credentials Across Four Services During Hugging Face Breach,” The Hacker News, July 29, 2026.
  2. Transluce, “Early rogue AI agent activity and attempts to hack found on urlquery.net,” Transluce, September 24, 2026.
  3. CNN, “Extended interview: Nvidia CEO Jensen Huang on fears about AI,” September 2026.
  4. Matthew Green, “Is sandboxing sufficient to contain rogue agents?,” A Few Thoughts on Cryptographic Engineering, September 30, 2026.
  5. Fortune, “AI ‘godfather’ Yann LeCun has ‘zero concerns’ about human extinction,” Fortune, October 1, 2026.
  6. Julie Bort, “AI safety conversations have gotten unbelievable,” TechCrunch, September 19, 2026.
  7. David Robinson, “I quit OpenAI because its culture is broken,” The Atlantic, October 2026.
  8. Wiz Research, “Off Guard: Breaking LiteLLM from Authentication Bypass to Cloud Compromise,” Wiz, 2026.
  9. Sysdig, “LLMjacking Evolved: Attackers Are Using Stolen AI Compute to Build Offensive Agentic Tools,” Sysdig, June 2026.