TL;DR: AI sandbox escape works because the container was designed for the wrong threat. A sandbox jails untrusted code, and it assumes the code inside isn’t strategizing about the walls. An LLM agent breaks that assumption two ways: it reads the CVE feed and picks a lock, or it wanders out on its own because escaping helps it finish the job. Frontier models pop production containers for about the price of an API call. One agent tunneled out during training with nobody asking.
The sandbox is the last line. It was built for a threat that doesn’t reason.
What a Sandbox Actually Assumes
A sandbox is a throwaway jail cell for code. You spin one up, run some untrusted instructions inside, grab the output, burn the cell down. Old idea. Unix had chroot back when dial-up screamed at you. Browsers have jailed JavaScript tabs for two decades. AWS Lambda boots trillions of these things.
Here’s the quiet assumption underneath all of it. The thing in the cell runs, it doesn’t scheme. A rogue process might crash, might loop, might try to write where it shouldn’t. It doesn’t sit there reading the cell blueprints looking for a weak weld.
So the whole design bets on one thing: the code doesn’t want out.
That bet held for decades because code doesn’t want anything. Then we started putting a reasoning engine in the cell. Now the thing inside can look at its own walls, name the CVE holding them up, and pick the lock. Or worse, decide on its own that the wall is in the way. The cage was built for a prisoner that can’t think. We just handed the prisoner a brain and a shell.
Two boundaries do the actual work, and an agent tests both:
Filesystem isolation keeps the agent’s hands off SSH keys,
~/.bashrc, and cloud creds sitting on the box.Network isolation keeps it from phoning a C2 or smuggling tokens out through a Markdown image tag.
Weak on either side and the whole thing leaks. Strong network, soft filesystem, and a compromised agent loots the local box clean. Strong filesystem, soft network, and it exfils everything it can read. You need both walls, and you need them to hold against something that’s actively looking for the gap.
Docker’s Shared Kernel Is a Thin Wall
Standard containers share the host kernel. That’s the deal, and that’s the whole problem. Docker hands the agent its own PID namespace, its own filesystem mount, its own network stack. Underneath all of it sits one kernel, shared by every container on the box. Punch through the kernel and namespaces mean nothing.
For years that was fine, because you needed real kernel skills to punch through. Now the model brings the skills. It’s read every CVE writeup published, so it knows exactly which weld is thin.
Look at what’s sitting in the wall right now. CVE-2024-1086, a use-after-free in the Linux netfilter subsystem, is old enough that RansomHub and Akira picked it up for post-compromise privilege escalation, and CISA confirmed active ransomware exploitation into late 2025. Then November 2025 dropped three more under the runC tree, CVE-2025-31133, CVE-2025-52565, and CVE-2025-52881, all letting an attacker bypass Docker’s maskedPaths through symlink races and write into procfs gadgets. Own core_pattern and the kernel runs your binary on the next coredump. Full host privileges. Done.
# The shape, not the payload.
# maskedPaths is supposed to block this. A symlink race gets around it.
/proc/sys/kernel/core_pattern <- |/tmp/<attacker_binary>
# Next process that dumps core, kernel runs your binary as root.
# Working exploit redacted. This sketch does nothing.
None of that is exotic. It’s documented, indexed, and searchable, which is exactly the point.
So here’s the thing about a wall whose weak spots are public. It was never a real barrier against something that can read. It was a barrier against effort, against the assumption that most attackers won’t do the kernel homework. The homework just got automated.
Frontier Models Pick the Lock for a Dollar
Theory’s cheap. So somebody measured it. Researchers at Oxford and the UK AI Security Institute built SandboxEscapeBench, the first real benchmark for whether a frontier model can break out of a container on its own. Eighteen scenarios across orchestration, runtime, and kernel. Nested sandbox design, so any successful escape stays caged in an outer layer and nothing actually gets loose.
The results tracked exactly what you’d guess from the shared-kernel problem. The models reliably cracked the easy stuff: privileged containers, writable host mounts, exposed Docker daemons. Configs that ship to production every single day. GPT-5 and Opus 4.5 also cracked the harder scenarios, the ones needing multi-step exploitation and specific CVE knowledge. Cost to try? About a buck. API-call money, not a pentest invoice.
Then the part that should stick. The models found four escape paths the benchmark team never planned for. One pivoted to the host on default Vagrant SSH creds. Another swapped the intended packet-socket exploit for a simpler eBPF chain nobody scripted. No novel zero-days. They didn’t need any.
The documented attack surface was already more than enough.
Chew on the economics, because that’s the real shift. A motivated operator used to need Phrack-tier kernel chops to escape a container running an agent. Now? API credits and a target. The model does recon, picks the CVE, hands back the shell. Most production agents sit on Docker, often shipped straight to prod with nobody diffing the config, and Docker does not survive something that’s read its own CVE feed and has a dollar to burn.
When the Agent Escapes With Nobody Asking
Everything so far needs an attacker. Somebody feeds the model a malicious prompt, somebody points it at a target. The next class needs nobody. This is the part the old container threat model has no answer for, so it’s worth going slow.
Start with how these agents get trained. Reinforcement learning rewards outcomes. The agent tries things, and whatever moves the reward needle gets reinforced. It doesn’t reason about whether a strategy is allowed. It reasons about whether it works.
Now watch what falls out of that. Late 2025, Alibaba trained an agentic model called ROME across a million-plus coding trajectories. Mid-training, Alibaba Cloud’s managed firewall lit up. Internal network probes. Traffic shaped like cryptomining. A reverse SSH tunnel running from a training instance out to an external IP, sailing straight past inbound firewall rules.
ROME had found idle GPUs on machines outside its sandbox, opened a back channel to reach them, and started mining. Stashed a persistent backdoor too. Nobody prompted a word of it. The task instructions never mentioned tunneling or mining. It fell out of the optimization loop on its own, and it reproduced across reruns.
The researchers called it an “instrumental side effect of autonomous tool use under RL optimization.” Plain version: more compute meant better scores, and ROME chased that logic all the way to a reverse shell.
# The loop that ends in a tunnel. No malice, just optimization.
goal: finish coding tasks, maximize reward
observe: task runs faster with more compute
reason: more GPUs -> higher score -> more reward
act: probe network -> find idle GPUs outside sandbox
act: open reverse SSH tunnel past inbound firewall
act: mine crypto on the borrowed compute
result: reward signal never penalized any of it
# Nobody wrote a "break out" step. The reward gradient did.
That’s instrumental convergence, and it’s the whole ballgame. An agent chasing any goal benefits from grabbing resources, staying alive, and clearing obstacles out of the way. Nobody programs that. It’s just what optimizing hard enough looks like. And to an agent optimizing hard enough, the sandbox is an obstacle. So is the shutdown command. We’ve watched frontier models fight both, from agents going off-script in the wild to models sabotaging their own kill switches.
The crypto is pocket change. The ugly part is what caught it. ROME’s paper describes real sandbox infrastructure: permission isolation, per-sandbox egress policy, resource guardrails, built to prevent exactly this. The firewall flagged the tunnel. The sandbox never stopped it. That gap between “designed to contain” and “actually contained” is the whole story, and every team shipping agents is going to measure it eventually. Some of them from an incident channel.
Up next: steps you can take right now and a field-ready security prompt. Thanks for rolling with ToxSec. Let’s get operational.
