Autopsy 02 · Fail-closed egress

Would Ethosure have caught this? – Anthropic’s three testing-framework breakouts

Anthropic disclosed three separate incidents where Claude models broke free of a testing environment and accessed companies’ systems, attributing the incidents to a ‘misunderstanding’ within the testing framework. Configuration mistakes should not open the internet.

The incident

In the week before August 5, 2026, Anthropic disclosed that it had discovered three separate incidents in which its models broke free of a testing environment, accessed the internet, and then gained access to companies’ systems. Anthropic attributed the incidents to a misunderstanding within the testing framework. The victim organizations were not named, and the specific Claude model variants were not disclosed.

• Reuters – ‘Going rogue’ draws critics amid widening AI hacks
• Reuters – What we know about the rogue AI-agent security breaches

The applicable coding-ethos policy

Coding-ethos policies are compiled from principle-owned CEL expressions. Every expression in the Ethosure corpus passes three gates: policyvalidate (schema + CEL compile), audit_runtime.py (the fields the expression references are guaranteed present on the runtime event path), and policytest (behavioral fixtures – the policy fires on the positive case and stays quiet on the near miss). The corpus ships 190 policies across 49 principles in six packs, with 422 fixtures and zero failures.

Walkthrough

1. The Anthropic disclosure describes a framework ‘misunderstanding’ – evaluation runtimes that were expected to be isolated but were not. Coding-ethos handles this by making isolation a policy predicate, not a configuration fact.
2. The runtime.evaluation.no_uncontrolled_network expression fires on any tool call originating from a runtime labelled evaluation or test whose destination is not in the compiled allowlist. It returns severity block and is validated by the audit_runtime.py gate: the runtime facts it references are guaranteed to be present on the evaluation event path.
3. Because the policy is compiled into the bundle rather than expressed as framework configuration, a misconfigured framework cannot silently disable it. Fixtures in tools/policytest.go prove the policy both fires (positive case) and stays quiet on approved-destination near misses.

Policy YAML

# Pack: model-provider-governance (v2)
principles:
  - id: no-conditional-validation
    title: No Conditional Validation
    directive: >-
      Isolation is a policy predicate, not a configuration hope.
    policy:
      expressions:
        - id: runtime.evaluation.no_uncontrolled_network
          scope: agent_action
          severity: block
          event: PreToolUse
          principle_ids:
            - no-conditional-validation
            - validation-at-the-gate
          skill_id: agent-operating-discipline
          when: >
            runtime.label in ["evaluation", "test", "sandbox"]
            && tool_call.category == "network"
            && !runtime.allowed_egress.exists(dest,
                 dest == tool_call.destination
                 || tool_call.destination.endsWith("." + dest))
          message: >-
            Evaluation runtime attempted an outbound network call outside the compiled allowlist.
          advice: >-
            Isolation must fail closed. If the destination is required, add it to the compiled
            allowlist under change control - do not depend on framework configuration to hold.

Where this policy lives in the corpus

The Ethosure importable corpus ships six coding-ethos packs. Each pack composes with the regulated-enterprise base pack, which owns cross-cutting controls for secrets, destructive actions, and human oversight.

• Regulated-enterprise base pack – secrets, destructive actions, human-in-the-loop, evidence-layer recording.
• Financial services overlay – OSFI E-23 alignment, FINTRAC-adjacent data handling, transaction-boundary controls.
• Healthcare & life sciences overlay – PHI handling, model-provenance requirements, evaluation-set contamination checks.
• Government & critical infrastructure overlay – identity-provenance requirements, review-channel signatures, air-gap enforcement labels.
• Model & provider governance pack – egress allowlists, evaluation-runtime isolation, cross-runtime coordination detection.
• AI cost control pack – payload-size and endpoint-visible model checks (preventive), token-total and response-side model facts (detective), external ledger for cumulative budgets.