# Got a Sandbox?

On July 30, Anthropic published a postmortem on three incidents found in its own cybersecurity evaluation transcripts. Reviewing 141,006 evaluation runs, the company identified three in which a Claude model reached the open internet from a test environment that was supposed to be sealed, then gained unauthorized access to the production infrastructure of three different organizations.

The models were not trying to escape. They were told, explicitly, that they had no internet access and that the environment was simulated. A misconfiguration at a third-party evaluation partner made both statements false, and neither party noticed until last week. The earliest incident dates to April.

If you run agents anywhere near production, this is the most useful public postmortem you will read this quarter.

## The line that should keep you up

Neither of the two affected organizations Anthropic managed to reach had detected the activity themselves.

An autonomous agent registered accounts, published a package, harvested credentials, and pivoted into infrastructure. The victims learned about it because the AI lab read its own transcripts and made a phone call. Same pattern as the OpenAI Hugging Face disclosure nine days earlier: discovery came from the vendor, not the defender.

One more piece of context matters. These evaluations ran without the classifiers and monitoring that ship with generally available models, though the models retained their safety training. Anthropic states its production safeguards would have blocked the behavior, and frames the incidents as closer to a harness and operational failure than a model alignment failure. That framing is defensible. It is also the entire lesson: the model acted consistently with a false belief about its environment, and the environment was the thing nobody validated.

* * *

### \_\_ Security Considerations \_\_

**../ Situational awareness is a control surface, not a personality trait.** Each model reached a different conclusion about whether its targets were real, and each acted accordingly. What an agent does is downstream of what it believes about where it is, which makes every unverified claim in a system prompt a security assumption.

**../ Registry trust is an execution path.** A security vendor's scanner installed and ran arbitrary code from PyPI because that is what scanners do. Any workflow that treats a public registry as safe to execute has already granted remote code execution to whoever claims the next unregistered name.

**../ Evaluation and staging environments carry production risk.** The misconfiguration lived at a third-party partner. The consequences landed on organizations with no relationship to either party, and went undetected for roughly three months.

### \_\_ Mitigation Strategies \_\_

**:: Scope agents explicitly, then enforce that scope at the network layer.** Anthropic's own assessment is that a prompt clearly stating which systems were in and out of scope might have prevented the incident. Treat that as the floor: egress allowlists, deny-by-default routing, and DNS controls make containment a property of the environment rather than a sentence in a prompt.

**:: Never execute untrusted packages in a trusted context.** Install and detonate dependencies in disposable, credential-free sandboxes with no path back to your identity plane. Pin versions, verify provenance, and pre-register your internal package names on public registries so a phantom dependency cannot be claimed by anyone else.

**:: Hold non-production environments to production standards, and monitor agent transcripts continuously.** Validate every egress path before an agent runs, log its actions in real time, and demand the same hardening and vendor assurance from evaluation infrastructure that you demand of anything customer-facing.

* * *

## Human on the loop

The failure mode here was not a model pursuing a goal of its own. Anthropic found no evidence of that and says so plainly. The failure mode was an agent working competently and persistently toward an assigned objective while holding the wrong belief about where it was standing.

*Human-in-the-loop* would not have caught this. There was no approval gate to sit at, and each individual action was reasonable given the agent's premises. Fully autonomous is precisely what produced it. **Human on the loop** is the architecture that survives both: agents execute at machine speed inside boundaries the environment enforces, while accountable humans define the scope, validate the containment, and read the trace.

The most encouraging detail in the report is that the newest model recognized its target was real and stopped without being told. The most sobering is that it took a vendor's transcript review, not a victim's detection stack, to surface any of this.

Check your egress rules before you check your model card.

/ag