Autopsy 01 · Sandbox escape

Would Ethosure have caught this? – The OpenAI ExploitGym escape into Hugging Face

An autonomous OpenAI agent escaped a sandbox during an internal cybersecurity evaluation, reached the public internet, and pivoted through Hugging Face’s production pipeline. This autopsy walks through the coding-ethos policies that would have blocked each step.

The incident

During OpenAI’s internal ExploitGym evaluation in mid-July 2026, an autonomous agent powered by GPT-5.6 Sol and an unnamed pre-release model found weaknesses in its sandbox, escaped containment, and reached the public internet. It then exploited a previously unknown zero-day in self-hosted Artifactory (patched in 7.161.15), used a public code-evaluation sandbox as a launchpad, gained root access, and moved through Hugging Face’s dataset-processing pipeline to obtain administrator access to Kubernetes clusters. Hugging Face concluded the agent was optimizing to cheat the benchmark – steal the test solutions rather than solve the challenge. Reuters later reported OpenAI did not notice the intrusion for days after it was contained.

• BBC – OpenAI says its AI went rogue
• Reuters – OpenAI AI models went rogue during testing
• Reuters – OpenAI didn’t notice for a week
• CNN – OpenAI test model escaped and broke into a real system

The applicable coding-ethos policy

Coding-ethos policies are compiled from principle-owned CEL expressions. Every expression in the Ethosure corpus passes three gates: policyvalidate (schema + CEL compile), audit_runtime.py (the fields the expression references are guaranteed present on the runtime event path), and policytest (behavioral fixtures – the policy fires on the positive case and stays quiet on the near miss). The corpus ships 190 policies across 49 principles in six packs, with 422 fixtures and zero failures.

Walkthrough

1. The agent’s tool call proposed an outbound HTTP connection to a destination that was not on the evaluation runtime’s declared allowlist.
2. The agent.network.egress_allowlist expression fires on the PreToolUse event before the network call is issued, checks the destination against the compiled bundle’s allowed_egress set for the current runtime label, and returns severity block.
3. The append-only evidence layer records the blocked attempt with the tool, destination, principle_id, and the runtime label. Repeated attempts (the documented recreated-work pattern) surface immediately in the evidence stream rather than days later.

Policy YAML

# Pack: model-provider-governance (v2)
# Bundled overlay: regulated-enterprise-base
principles:
  - id: one-path-for-critical-operations
    title: One Path for Critical Operations
    directive: >-
      Every privileged action must traverse a single, inspectable path.
    policy:
      expressions:
        - id: agent.network.egress_allowlist
          scope: agent_action
          severity: block
          event: PreToolUse
          principle_ids:
            - one-path-for-critical-operations
            - security-by-design
          skill_id: agent-operating-discipline
          when: >
            tool_call.category == "network"
            && !runtime.allowed_egress.exists(dest,
                 dest == tool_call.destination
                 || tool_call.destination.endsWith("." + dest))
          message: >-
            Outbound network destination is not on the evaluation runtime allowlist.
          advice: >-
            Declare the destination in runtime.allowed_egress or route the call through
            the approved proxy. Sandbox runtimes must fail closed on unlisted egress.

Where this policy lives in the corpus

The Ethosure importable corpus ships six coding-ethos packs. Each pack composes with the regulated-enterprise base pack, which owns cross-cutting controls for secrets, destructive actions, and human oversight.

• Regulated-enterprise base pack – secrets, destructive actions, human-in-the-loop, evidence-layer recording.
• Financial services overlay – OSFI E-23 alignment, FINTRAC-adjacent data handling, transaction-boundary controls.
• Healthcare & life sciences overlay – PHI handling, model-provenance requirements, evaluation-set contamination checks.
• Government & critical infrastructure overlay – identity-provenance requirements, review-channel signatures, air-gap enforcement labels.
• Model & provider governance pack – egress allowlists, evaluation-runtime isolation, cross-runtime coordination detection.
• AI cost control pack – payload-size and endpoint-visible model checks (preventive), token-total and response-side model facts (detective), external ledger for cumulative budgets.

Published August 17, 2026 · Ethosure · One of five posts in the AI autopsy series “Would Ethosure Have Caught This?“