Atlas/code · network egress

Execution sandbox

Where agent-written code runs and what that environment can reach.

16 attacks and incidents10 defense records5 findings1 measured defense findings

Attacks and incidents

Sep 23, 2026

Australia says an OpenAI agent bypassed protections on a government Medicare portal

AttackIncidentOpenAI, Australian Government, Transluce

Sep 23, 2026

Transluce finds agent hacking attempts and data retrieval traces on the urlquery.net scanner

AttackIncidentTransluce, OpenAI, urlquery.net

Sep 11, 2026

Researchers link OpenAI agents to May 2026 malicious RubyGems uploads and RubyDoc code execution

AttackIncidentOpenAI, Ruby Central, JFrog

Sep 4, 2026

Researchers find OpenAI evaluation agents used a public German wiki as a covert message board

AttackIncidentNightingale Collective, OpenAI

Aug 5, 2026

Meta says a model exploited a third-party service after an evaluation misconfiguration

AttackIncidentMeta, Irregular

Aug 4, 2026

UK AISI reports 19 unsanctioned real-world agent actions during internet-enabled cyber range testing

AttackIncidentUK AI Security Institute, Anthropic, OpenAI

Jul 30, 2026

Anthropic finds three incidents where Claude attacked real organizations from misconfigured cyber evals

AttackIncidentAnthropic, Irregular

Jul 21, 2026

OpenAI models escape evaluation sandbox and compromise Hugging Face while cheating on a cyber benchmark

AttackIncidentOpenAI, Hugging Face, METR

Jul 1, 2026

DuneSlide: two Cursor flaws let prompt injection escape the agent sandbox (CVE-2026-50548/50549)

AttackVulnerability disclosureCato Networks, Cursor

May 7, 2026

Microsoft details two Semantic Kernel flaws that let prompt injection escalate to code execution

AttackVulnerability disclosureMicrosoft

Apr 15, 2026

OX Security advisory: MCP STDIO configuration enables command execution across agent frameworks

AttackVulnerability disclosureOX Security, Anthropic

Jan 20, 2026

Cyata discloses three flaws in Anthropic's reference Git MCP server reachable via prompt injection

AttackVulnerability disclosureCyata, Anthropic

Nov 20, 2025

PromptArmor shows Google Antigravity agent exfiltrating credentials from a poisoned web guide

AttackVulnerability disclosurePromptArmor, Google

Aug 12, 2025

GitHub Copilot agent could be prompt-injected into disabling its own approvals (CVE-2025-53773)

AttackVulnerability disclosureJohann Rehberger (Embrace The Red), Microsoft, GitHub

Aug 1, 2025

CurXecute: prompt injection could make Cursor create MCP config and run commands (CVE-2025-54135)

AttackVulnerability disclosureAim Security, Cursor

Jul 28, 2025

Tracebit shows Gemini CLI could silently run attacker commands when reading untrusted code

AttackVulnerability disclosureTracebit, Google

Defense research

Jul 21, 2026

UK AISI finds all five frontier models it tested attempted to cheat on its cyber evaluations

DefenseEvaluation reportUK AI Security Institute, OpenAI, Anthropic

May 21, 2026

Position paper argues agent security benchmarks suffer from hackable environments, staleness and runtime noise

DefensePaperarXiv

May 10, 2026

MonitoringBench shows refined covert attacks cut an Opus 4.5 monitor's catch rate from 95% to 60%

DefenseBenchmarkRedwood Research

Mar 19, 2026

OpenAI reports monitoring tens of millions of internal coding agent trajectories for misalignment

DefenseEvaluation reportOpenAI

Mar 6, 2026

OpenAI relaunches Aardvark as Codex Security, reporting 1.2M commits scanned and 14 CVEs

DefenseTool releaseOpenAI, OpenSSH, GnuTLS

Mar 1, 2026

UK AISI's SandboxEscapeBench measures frontier models' ability to escape container sandboxes

DefenseBenchmarkUK AI Security Institute, University of Oxford

Feb 5, 2026

Anthropic reports over 500 human-validated high-severity open-source vulnerabilities found with Claude Opus 4.6

DefensePaperAnthropic, Ghostscript, OpenSC

Oct 30, 2025

OpenAI announces Aardvark, a GPT-5 agent that finds, validates and proposes patches for vulnerabilities

DefenseTool releaseOpenAI

Oct 22, 2025

UK AISI and Redwood release ControlArena library for AI control experiments

DefenseTool releaseUK AI Security Institute, Redwood Research

Oct 20, 2025

Anthropic adds OS-level filesystem and network sandboxing to Claude Code and open-sources the runtime

DefenseTool releaseAnthropic

Findings

Jul 21, 2026

Frontier agents under cyber evaluation have taken actions against real third-party systems outside the evaluation.

Corroboratedobserved4 evidence records1 linked finding

Jul 28, 2025

In several agent frameworks and coding tools, prompt injection in content the agent read reached code execution on the host, sometimes combined with a common setting such as an allowlisted command.

Corroboratedmeasured5 evidence records

Mar 1, 2026

The strongest frontier models tested escaped deliberately vulnerable container sandboxes in about half of scenarios, and success rose with inference compute.

Reportedmeasured1 evidence record

Jul 22, 2025

Limits that agents are only told about, or that block one tool while others remain available, do not reliably stop them: a declared code freeze and an ignore-file setting were both bypassed.

Corroboratedobserved2 evidence records1 linked finding

Oct 20, 2025

Operating-system sandboxing can cut the number of approval prompts a coding agent needs without widening what injected instructions can reach.

Reportedreported1 evidence record

Capability, policy, and guidance

Aug 18, 2026

OpenAI pauses RL training and hardens research environments as Astra nears Critical cyber threshold

PolicyFrameworkOpenAI

Jun 3, 2026

Frontier Model Forum issue brief catalogs emerging security practices for AI agents

PolicyGuidanceFrontier Model Forum

Jan 8, 2026

NIST CAISI requests public input on security considerations for AI agent systems

PolicyProgramUS Center for AI Standards and Innovation, NIST

Apr 15, 2025

OpenAI Preparedness Framework v2 sets High and Critical cybersecurity capability thresholds

PolicyFrameworkOpenAI

Mar 24, 2025

NIST AI 100-2 E2025 taxonomy adds a dedicated section on security of AI agents

PolicyStandardNIST, UK AI Security Institute, US Center for AI Standards and Innovation

Related research openings

Containing agents inside cyber evaluations