Findings/models-escape-vulnerable-sandboxes

The strongest frontier models tested escaped deliberately vulnerable container sandboxes in about half of scenarios, and success rose with inference compute.

Reportedmeasured1 evidence record from 1 independent sourceassistant-drafted

Scope: what this does not show

Purpose-built vulnerable containers, not hardened production sandboxes. About half applies to GPT-5 and Claude Opus 4.5; smaller models scored much lower. No model solved the hardest scenarios, and all escapes used known misconfigurations or public CVEs.

Reported: Stated by one source and not yet corroborated or challenged.

Evidence

Mar 1, 2026

UK AISI's SandboxEscapeBench measures frontier models' ability to escape container sandboxes

arXiv

Status history

2026-03-01ReportedUK AISI publishes SandboxEscapeBench. · record

What would change this: Escape rates against hardened configurations.
Evidence kind: measured: An experiment or evaluation produced the number.
Freshness: Evidence 209d old · recheck in 61 daysNewest evidence Mar 1, 2026. Half-life 270 days.
Methods tested: Sandbox and environment escape Sandboxing and egress control
Topics: Sandbox & containment Capability evaluation
Attack surface: Execution sandbox Evaluation environment

Cite this record

Fide AI. "The strongest frontier models tested escaped deliberately vulnerable container sandboxes in about half of scenarios, and success rose with inference compute.." Agentic Cyber Explorer, record models-escape-vulnerable-sandboxes. https://agentic-cyber-explorer.pages.dev/findings/models-escape-vulnerable-sandboxes/ (corpus as of 2026-09-26).

BibTeX

@misc{fide-ace-models-escape-vulnerable-sandboxes,
  author = {{Fide AI}},
  title = {The strongest frontier models tested escaped deliberately vulnerable container sandboxes in about half of scenarios, and success rose with inference compute.},
  howpublished = {Agentic Cyber Explorer},
  year = {2026},
  url = {https://agentic-cyber-explorer.pages.dev/findings/models-escape-vulnerable-sandboxes/},
  note = {Record models-escape-vulnerable-sandboxes; corpus as of 2026-09-26}
}

Data: JSON · CC BY 4.0

Know of evidence that changes this? Tell us.