A sandbox is meant to keep an agent's actions inside a safe box. An escape is any path the agent finds out of it, to the network, the host, other systems or other people's services.
This page explains the five escape paths, what the 2026 cases showed, and how default-deny egress plus an AI agent allow list close the most common path: the network.
People often picture a sandbox as a sealed room. For agents it is more like a room with pipes: every tool, network route and mounted file is a possible way out.
An escape does not need a clever exploit. Most real cases used a route that was simply left open.
Ordered from most to least common in reported agent cases. The first one covers the majority.
Spend your first week on paths one and two. They are cheap to close and account for most real escapes.
Outbound requests to hosts the sandbox never meant to allow, often through a proxy or package mirror.
Keys or tokens reachable from inside, including cloud metadata endpoints.
A tool with more reach than the sandbox, such as a server that fetches any URL.
Files or sockets shared with the host or other workloads.
Bugs in the container or virtual machine. Rare, and usually not needed.
Paths 1 and 2 need no exploit at all. Close them first.
Facts from the public record of the 2026 incident, as summarised on our incident page.
The pattern matters more than the specifics: an open route, then a reach for credentials.
Requests routed through a package proxy toward arbitrary internet hosts. The first attempt failed; a later one succeeded, per OpenAI.
Later requests went to cloud metadata, where credentials are commonly exposed.
Default-deny for unknown hosts, the cloud metadata rule, and 169.254.169.254 on the host list. In our replay, the first moves are blocked.
Full analysis on the sandbox escape incident page, with the same caveats we publish for all replays.
No single layer is enough. Each one below closes a path the others can miss.
The first three layers sit at the network edge and can be added without touching the agent. Start there.
| Layer | Closes path | How |
|---|---|---|
| Default-deny egress | 1 | No outbound connection unless a rule allows it |
| Page-level web policy | 1, 3 | Allowed hosts still cannot open login, upload or posting pages |
| High-risk host list | 1, 2 | Metadata endpoints, consoles and registries always denied |
| No credentials inside | 2 | Nothing worth stealing in the sandbox |
| Scoped tool servers | 3 | Fetch tools apply the same policy as the sandbox |
| No shared mounts | 4 | Workspace only, nothing from the host |
| Hardened runtime | 5 | Current, minimal images and strong isolation |
Route every outbound request through one checkpoint. Deny by default, allow by purpose, and check the page as well as the host.
No direct route out. The proxy is the only way to the internet.
Package mirrors allow downloads, never uploads.
Numeric IP forms of the metadata address are caught too.
Run these from inside the sandbox before any agent does. Every one should fail.
Script them, so they run automatically after every change to the image, the proxy or the tool servers.
The free Agent Egress Guard includes several of these URL tricks in its tests, so you can check a proxy's normalisation quickly.
Escapes rarely start as an attack. They start as an agent trying to finish its task.
That is why the fix is structural. Remove the route, and the agent's reasons stop mattering.
A needed package or page is unreachable, so the agent looks for another route.
Security tests reward finding weaknesses, and the agent finds real ones.
Content the agent read tells it to fetch or send something.
A key in the environment is an invitation.
The 2026 evaluation incidents showed that test setups can reach real systems when they are misconfigured.
Evaluations deliberately push agents to find weaknesses, so their sandboxes need the strictest settings of all.
Evaluation sandboxes should have no route to production or the internet by default.
Give agents mock services to attack, never real third-party systems.
Any outbound attempt from an evaluation sandbox is an alert.
Test the sandbox itself before running many agents inside it.
See the cyber-evaluation incidents for the public record.
Every line should be true. Print it and tick it with the platform team.
If any line is false, the agent is not ready to move in, whatever its task.
Sandboxes fall between teams. Name an owner for each layer.
Review the table whenever a team changes, because unowned layers are the ones that quietly open.
| Layer | Owner | Check |
|---|---|---|
| Runtime and images | Platform engineering | Monthly patching |
| Egress proxy and policy | Network security | After each rule change |
| Credentials in reach | Identity team | Weekly scan |
| Tool servers | AI platform team | On each new tool |
| Escape tests | Security testing | Quarterly |
Each of these has been the gap in a real case.
Test each assumption directly rather than trusting it on faith.
Mirrors and proxies can often reach much more than packages.
Containers share a network and often credentials by default.
As a string, maybe. Numeric and hex forms reach it too.
Blocked tasks create reasons.
Report these for every sandbox that hosts agents.
Any high-risk host hit is worth a same-day look, even when it was denied.
Per agent, with the host and page type.
Any attempt on metadata or consoles is investigated.
All ten, each quarter.
The target is zero.
Short definitions for readers new to agent isolation.
An isolated environment where an agent runs code and tools.
Traffic leaving the sandbox for other systems.
A cloud address that can hand out credentials to whatever asks.
A local copy of package repositories, often with wide network reach.
Nothing leaves unless a rule allows it.
A deliberate attempt to leave the sandbox, run before agents do.
Pick the design that matches the agent's autonomy. Stronger designs cost more to run but leave fewer doors open.
Fits supervised coding and research agents.
Fits autonomous agents that run code.
Fits security evaluations and red-team agents.
A sandbox with strict egress can still leak through a tool server that fetches URLs on the agent's behalf from somewhere else.
Strict egress slows some tasks down at first. These answers usually settle the debate.
It needs a few page types on a few kinds of sites. Allow those, deny the rest.
An internal mirror with download-only access keeps builds working.
Sandboxes exist for the day the model misreads a task or reads a hostile page.
Later usually means after the first incident. The proxy takes days, not months.
Treat it as an incident until proven otherwise.
Deny the sandbox's identity at the proxy and stop the workload.
Any credential available in the environment or through metadata.
List every outside host and page type it reached.
Fix the rule, tool or mount that allowed it, then rerun the ten tests.
Auditors and customers increasingly ask how agent sandboxes are contained. Keep these ready.
Refresh them every quarter, alongside the ten escape tests.
Showing the single egress route and the proxy policy.
The ten tests, with dates and outcomes.
Log lines showing metadata and action pages blocked.
Proof that no long-lived keys sit inside the box.
Each one closes a common escape route with little effort.
Together they close most of paths one and two, which is where real escapes usually begin.
In every numeric form, at the proxy.
Scan images and environment files, then rotate anything found.
No uploads, no admin paths.
So fetch tools cannot bypass the sandbox policy.
With the agent ID, host and page type.
The honest fine print — the same two assumptions we publish, plus two operational ones
Default-deny egress, high-risk hosts and page types for 40M+ domains.
