AI sandbox breakouts: Peril or just PR?

When security disclosures read like marketing collateral

Just days after OpenAI admitted that one of its advanced models had broken out of its sandbox to attack Hugging Face (and, as emerged later, another company too), Anthropic came out with its own statement.

The company’s Claude models reached the internet from supposedly secure testing environments on three separate occasions and compromised third-party systems, it disclosed, following an analysis of 141,006 evaluation runs.

Both companies framed the incidents as evidence of rapidly advancing cyber capabilities. Both have also presented themselves as transparent actors learning from mistakes.

So, are they a warning bell or just a sophisticated PR exercises by companies looking to stay in the headlines ahead of going public?

Or are they, perhaps, a bit of both?

Similarities and differences

In both cases, models were undergoing security evaluations with many of their usual guardrails disabled, when they managed to escape their confines. In both cases they pursued their evaluation goals, exploiting vulnerabilities and compromising real-world systems to meet their aims. And in both cases, the companies say that human error and poorly designed testing environments played a part.

However, in the OpenAI case, models escaped by exploiting a zero-day vulnerability in JFrog's Artifactory software before moving through OpenAI's infrastructure and ultimately compromising Hugging Face systems in search of benchmark solutions. OpenAI said the incident demonstrated state-of-the-art cyber capabilities, including vulnerability chaining and long-horizon planning.

Meanwhile, Claude models exploited weak passwords, unauthenticated endpoints and exposed services, gained access to real organisations, published a malicious package to PyPI and, in one case, accessed production data. Anthropic says “Claude believed everything it initially encountered was part of the simulation”, rather than deliberately attacking real-world systems.

The latest Claude incident is also very different from Anthropic’s earlier “Mythos sandbox escape”, which Computing reported in April. In that case the model was explicitly instructed to break out of its sandbox and contact researchers if successful – which it did, earning its maker a great deal of publicity in the process.

Subsequently, OpenAI said its models too had performed a similar feat.

Peril or PR? Or both?

On the face of it, neither OpenAI nor Anthropic benefits from admitting that models under their control reached real-world systems they should never have touched. That looks like incompetence and possible law-breaking to boot.

But through prompt disclosure both companies present themselves as responsible stewards of increasingly powerful technology - while simultaneously highlighting just how capable their latest models have become.

Indeed, Anthropic’s disclosure describes Claude's willingness to go to "extensive lengths" to complete an objective. OpenAI does not miss the chance to namecheck its “GPT‑5.6 Sol and an even more capable pre-release model” that were implicated in the Hugging Face attack, which it describes as "an unprecedented cyber incident, involving state-of-the-art cyber capabilities."

This is the language of PR, not science.

In both cases the “disclosures” look suspiciously like marketing collateral, comparing newer models favourably with older ones and ensuring the world knows what actions they are taking, individually and collaboratively, to make things better.

And of course, while neither company has publicly committed to a specific IPO timetable, both are under pressure to justify enormous valuations and investment rounds. Context is important.

The wolf may be real

Having incident reports function jointly as marketing is obviously not ideal - not least because of the “boy who cried wolf” effect- but it doesn’t mean the incidents themselves should be dismissed as pure PR stunts.

The events themselves suggest that the most advanced models have become increasingly capable at pursuing objectives over extended periods, adapting when plans fail and exploiting opportunities that human operators did not anticipate or plan for.

They demonstrate that agentic systems are increasingly capable of performing complex cyber tasks when given autonomy and access to tools, and it should be assumed that these capabilities will continue to improve rapidly.

So, while it pays to be aware of the messaging, it would be unwise to ignore the warning signs. If even two of the world's most prominent AI labs are struggling to contain their own frontier models during controlled evaluations, security leaders should assume that similarly capable systems will soon be available to attackers as well as defenders.

The hype is certainly there, but the direction of travel is also clear.