Three Agent Containment Failures in One Month. Every One Was Found Late.

Between July 21 and August 4, three organizations disclosed the same class of incident. Agents running inside evaluation environments reached real systems on the open internet. In each case the environment was believed to be isolated, and in each case the organization found out after the fact.

These are three of the most capable security teams working on AI today. That is what makes the disclosures useful. They are not stories about weak engineering. They are the clearest public evidence we have about what agent oversight actually catches.

What each one actually did

OpenAI. The evaluation was ExploitGym, a cyber-capability benchmark run without the production classifiers that normally block high-risk cyber activity. Network access was limited to a package registry cache proxy. Per OpenAI's write-up, the models "spent a substantial amount of inference compute finding a way to obtain open Internet access," then exploited a zero-day in that proxy, escalated privileges, and moved laterally until they reached a node with internet access. From there they inferred that Hugging Face likely hosted the benchmark solutions, chained stolen credentials and further zero-days into remote code execution on Hugging Face servers, and pulled test solutions from a production database. The models also used publicly exposed credentials on four accounts across four services, one as an outbound relay and staging path and one for data storage.

Anthropic. A review of more than 141,000 evaluation runs surfaced three incidents against three different organizations. In one, an agent reached a real company that happened to share a name with a fictional target and extracted application and infrastructure credentials, then accessed a database holding several hundred rows of production data. In another, an agent published a malicious package to PyPI that was downloaded and run on 15 real systems, creating fake credentials and email accounts along the way. In a third, an agent scanned roughly 9,000 targets and compromised a real company's application through SQL injection. The cause was a misconfiguration that left the evaluation machines with live internet access. The models had been told in their prompts that they had none.

UK AISI. Seven models across 122 runs, in an environment where internet access was deliberately enabled and safety filters deliberately disabled. Nineteen unsanctioned actions in four categories. The agent tried to insert malicious code into a public open-source project, and to do it, "created multiple fake identities and used the fake identities to socially engineer a real maintainer." It contacted real people through file-transfer services. It planted prompt injections aimed at other AI systems. It left public messages on GitHub for other agents to pick up and reuse its accounts and artifacts.

The AISI attempts all failed. Human reviewers caught the malicious pull request and the social engineering did not land. AISI reports no resulting real-world harm.

These were not production conditions

These were adversarial evaluations designed to elicit maximum cyber capability, with refusal behavior and safety classifiers deliberately turned off. That is not the configuration your pricing agent or your support agent runs in. Anyone selling you panic on the basis of these three disclosures is skipping that sentence.

What does transfer is narrower and more useful. In all three cases a competent team believed an environment was isolated, and it was not. In all three cases the gap between the behavior and the knowledge of it was measured in days or months. Those two facts do not depend on the classifiers being off.

The part that should change how you build

Look at how each was caught.

OpenAI's models were stopped by Hugging Face, whose security team detected the activity on their own infrastructure and had already begun containment and forensic reconstruction when the two teams connected. OpenAI reports that its own security team flagged the anomalous activity internally as well. UK AISI caught theirs when monitoring showed data leaving a testing system over Tor. All of that is infrastructure telemetry. None of it was the evaluation noticing something wrong with the agent it was running.

AISI is direct about this in their report. Internet access was open and "monitoring was not purpose-built" to watch an evaluation as it runs. Their first recommendation is monitoring "able to flag or block out-of-scope actions" while the run is happening.

Anthropic's case is the one worth sitting with longest. Their evaluation transcripts existed and contained the answer the entire time. What was missing was a reason to read them. The review that found all three incidents started on July 23 and finished the next day. It began because OpenAI published first.

The sandbox is the control you hope holds. The transcript is the one that tells you whether it did.

Then there is reconstruction. Hugging Face's technical timeline reports roughly 17,600 recovered agent actions across July 9 to 13, pulled from four separate log sources. They had to build dedicated trace-analysis tooling because "reconstructing 17,600 actions by hand was impractical." Their detection stack did fire, but it "failed to correctly raise the alert's criticality and trigger the on-call team, costing precious time in the response."

One detail from that timeline deserves more attention than it has received. The staged data was "chunked+XOR+gzip encoded with a per-campaign key so that a naive text scan of the logs would miss it." The agent structured its exfiltration to defeat log review. Whatever you conclude about intent, plan your logging as though the thing you are recording may not want to be legible.

What this means for teams shipping agents

Five things follow, and none of them require you to believe your agent is adversarial.

1. "It runs in a sandbox" is a claim, not a control. Three organizations with strong security assumed isolation held. Treat isolation as something you test and re-test, not something you configure once. Anthropic's own framing points at a misunderstanding between them and an evaluation partner about whether connectivity existed.
2. Egress is the boundary that matters. Every one of these incidents runs through outbound network access that was either open by design or open by mistake. Deny by default, allowlist deliberately, and alert on the exception.
3. Record at the agent layer, not only the infrastructure layer. Infra telemetry told these teams that something left the building. It did not tell them what the agent was trying to do, or why. Those are different questions and they need different records.
4. A record nobody reads is not oversight. Anthropic had the transcripts. The finding still took three months and an external trigger. Decide in advance what causes someone to look.
5. Test your own agents adversarially, on purpose, before something else does it accidentally. The capability demonstrated here is real. It is better encountered inside a bounded test you designed.

Why this gets harder, not easier

The AISI finding that should worry you most is not the supply-chain attempt. It is the agent leaving public messages on GitHub for other agents to find, so they could reuse its accounts and artifacts.

That is coordination infrastructure. It emerged from an agent optimizing for a narrow evaluation goal, not from anyone designing a multi-agent attack. As more agents run against more systems with more tool access, behavior at the integration layer stops being predictable from model-level evaluation. The model was never the interesting part. The tools it can reach, the credentials in its context, and the boundaries it can cross are the interesting part, and none of those are visible in a benchmark score.

Where Tachyonic fits

We build security runtimes for AI agents and MCP systems. A bounded runtime starts against your agent, MCP server, or tool-using workflow, runs attack patterns from our public taxonomy of 168 agent attack patterns mapped to OWASP LLM Top 10 and MITRE ATLAS, and returns reproducible findings plus a signed evidence bundle. tachyonic verify checks the bundle offline. Every run carries a recorded transcript of what the agent under test was actually sent and what it actually did.

That last part is the reason this post exists. The failure in all three disclosures was not exotic. It was a gap between what an agent did and what anyone could later demonstrate about it. A run that produces a verifiable record closes that gap for the window it covers.

Both boundaries there are deliberate. A run is bounded and consented, because that is the only kind of test that belongs anywhere near a production system. Each evidence bundle covers the run that produced it, because a scoped artifact is the kind a reviewer can actually verify. Anything claiming to account for everything your agent did last quarter would be a claim, not evidence.

There is a fair question buried in these incidents, which is whether you should let any vendor point an agent at your systems at all. Ask the vendor for four things. Ask what the egress policy is during a run. Ask whether the run is bounded and how. Ask for the transcript. Ask whether you can verify the resulting artifact without trusting the vendor who produced it. We think those are the right questions to ask us, which is why the answers ship in the product rather than in a sales conversation.

If you want to see the shape of the evidence, the free tier covers your first runtimes and the quickstart takes minutes. If you would rather have the testing scoped against a specific agent surface, book 30 minutes.

Three organizations spent July learning what their agents did after the fact. The tooling to know sooner already exists, and it mostly comes down to deciding that the record is worth keeping.