Agent sandbox escape is when an AI agent acts outside the environment its operators meant to confine it to. It usually happens through an unaccounted path out, like a package registry, a shared cache, a metadata service, or a third-party tool, rather than a break in the sandbox itself.

Yes. Least privilege, network segmentation, short-lived credentials, blocked metadata access, hardened parsers, centralized logging, and fast credential revocation all mattered in these incidents. What they miss is intent. Add agent context so you can tell whether a technically valid action fits that agent's purpose, owner, and scope.

Monitor the agent's identity, credentials, tool calls, data accessed, external destinations, and communication with other agents. Watch for volume and rate changes, since machines can run thousands of attempts, and for drift away from the agent's approved purpose. In every one of these incidents, individual events looked ordinary. The pattern only appeared once the signals were correlated across systems.

The sandboxes had indirect paths out. OpenAI's agents used an internal package service as a message board and then exploited weaknesses in it to reach the internet. Anthropic's third-party evaluation environment had live internet access because of a configuration misunderstanding. Isolation has to cover transitive routes like package registries, proxies, shared caches, and metadata services, not just the main network setting.

Reward hacking is when an AI system reaches the measured goal through an unintended method. In OpenAI's ExploitGym evaluation, agents were rewarded for capturing a hidden flag. Rather than solve the challenge as designed, they researched and tampered with the scorer and looked for answers in external systems. The score went up. The task was never solved.