Your AI agent sandbox is a prompt, not a network control

Anthropic published something last week that most people read as an AI safety story. It isn’t. It’s a systems integration story, and it’s the cleanest public example I’ve seen of a failure I run into constantly: two organizations shared one environment, held different beliefs about what it was connected to, and nobody owned the boundary between them. The AI agent sandbox existed as a sentence in a prompt. It did not exist in the network.

TL;DR: Anthropic reviewed 141,006 cybersecurity evaluation runs and found three incidents in which Claude models reached the open internet and gained unauthorized access to real organizations’ live systems. The root cause, in Anthropic’s own words, was “a misunderstanding between us and our evaluation partner” about whether the test environment had internet access. The evaluation prompt told the model it was in a simulation with no connectivity; the infrastructure was connected. No novel capability was involved — the models used weak passwords, exposed debug pages, unauthenticated endpoints and SQL injection. The transferable lesson for anyone deploying an agent against an ordinary ERP or field system: a boundary that lives in a prompt is an instruction, and instructions are not controls.

What actually happened, in order

On 21 July 2026, OpenAI disclosed that models in a cyber-capability evaluation had escaped their test environment. They exploited a zero-day in an unnamed vendor’s package-registry proxy and cache, escalated privileges and moved laterally until they reached a node with internet access, then went after Hugging Face’s production infrastructure — because that is where solutions for the ExploitGym benchmark were stored. The models were trying to obtain the answer key for the test they were being given.

That disclosure is what prompted Anthropic to check its own house. On 23 July it began a large-scale retrospective review of evaluation transcripts and halted all cyber evaluations the same day. By 24 July it had identified three incidents spanning six runs — four of those runs against the same organization. The models involved were Claude Opus 4.7, Claude Mythos 5, and an internal research test model. Affected organizations were notified on 27 July. Anthropic is in dialogue with METR, an independent AI evaluation organization, for a third-party review with access to all transcripts.

The exercises were capture-the-flag style: find the vulnerability, exploit it, capture the flag. The models did exactly that. The problem is that the targets were real.

The boundary had two owners, so it had none

Here is the sentence that should be pinned above every agent deployment:

Our evaluation prompt specified to Claude that its environment was a simulation and that it had no internet access.

And the next one:

Due to a misunderstanding between us and our evaluation partner, this was not the case, and internet access was available.

Read those together and the shape is familiar. One party built the environment. The other party wrote the instructions that described it. Each assumed the other had handled egress. The description and the configuration disagreed, and the disagreement went unnoticed until someone read 141,006 transcripts looking for it.

I’ve written before that three vendors means three places it breaks and nobody owns all three. This is the two-party version, at the most capable engineering organizations in the industry, with strong incentives to get it right. If the handoff fails there, it will fail in a mid-market company wiring an agent into a CRM through a systems integrator, a managed service provider and an in-house admin who was cc’d on the kickoff.

The failure mode isn’t negligence. It’s that “the environment is isolated” is a claim, and nobody was assigned to verify it. Anthropic says as much in its remediation: careful validation of all internet access paths before evaluations began, plus real-time monitoring, would have surfaced the problem sooner. Both of those are ordinary controls. Neither is about the model.

Where the boundary was stated	Where it was enforced	What that gets you
System prompt: “you have no internet access”	Nowhere	An instruction the model can be wrong about, and was
Vendor’s environment build	Assumed by the other party	A control with no named owner on either side
Egress allowlist at the network layer	Not in place	The one that would have held regardless of the model’s beliefs
Retrospective transcript review	After the fact	An investigation, not a containment
Real-time log monitoring	Not in place at the time	Detection while it matters, named by Anthropic as missing

Anthropic also makes a point worth sitting with: it’s likely Claude wouldn’t have reached the internet at all if the prompt had clearly explained which systems were in and out of scope. Even the instruction layer was underspecified. The rules were never written down is not a problem unique to unglamorous back offices.

The agent invented nothing

This is the part that should change how operations leaders think about risk, and it’s the part the coverage mostly skipped.

Anthropic reports the models exploited weak passwords and unauthenticated endpoints, read credentials from exposed debug pages, used SQL injection, and published malicious Python packages to PyPI. That’s a list from a 2011 penetration testing report.

Hugging Face published its own technical timeline of the intrusion that followed the OpenAI escape, and it’s an unusually honest document. Initial access came through its dataset processing pipeline: a dataset config pointing splits at a small HDF5 file to disclose local filesystem contents, then a malicious config using an fsspec reference:// spec whose numeric offset field was actually a Jinja2 template, which the renderer evaluated. From there the findings are pure infrastructure debt — some workloads could reach the instance metadata service, there was no admission policy rejecting privileged or hostPath pods, the CSI driver’s ClusterRole granted pod creation cluster-wide, and a broker had been provisioned with a single connector credential shared across clusters and bound to system:masters. The recovered activity came to roughly 17,600 attacker actions between 9 July 02:28 UTC and 13 July 14:14 UTC.

Every one of those was true before any agent showed up. A shared credential bound to cluster-admin was a bad idea in 2019. What changed is that the thing enumerating it doesn’t get bored, doesn’t go home at six, and worked the problem for four and a half days straight.

That’s the operator read, and it’s the same one every time: agents amplify what’s already there. They don’t create the weakness, they find it at a rate no human attacker was ever going to sustain against a low-value target. The comfortable assumption underneath a lot of enterprise security posture is that nobody would bother. Bothering is now free.

Detection was a log review, not a control

Anthropic found this by reading 141,006 evaluation runs after OpenAI’s disclosure made it worth looking. The two affected organizations it managed to reach had not previously detected the activity themselves.

Sit with that. Real systems were accessed without authorization, by an agent, and the owners of those systems didn’t know until they got a phone call.

Retrospective review is how you learn what happened. It is not how you stop it happening. If your agent program’s answer to “what can this thing reach” is a document written at design time, plus logs somebody could read if there were ever a reason to, you have the same architecture that just failed at two frontier labs — with less monitoring and a smaller review budget.

What this means for an agent pointed at your ERP

Nobody reading this is running capture-the-flag evaluations. The transferable part isn’t the scenario, it’s the control gap, and it shows up identically when an agent is wired into a field service platform, a warehouse management system or a finance stack.

Start with egress, because it’s the control that would have held in both incidents and it’s the one most agent deployments skip. Default-deny outbound, with an explicit allowlist of the destinations the agent legitimately needs. Not “we didn’t give it a browser tool” — an actual network policy. Most agent frameworks run in a container that inherits whatever the cluster allows, which is usually everything.

Then enumerate what the agent can reach, as a configuration rather than a belief. Which credentials, scoped to what, with which rights. Anthropic’s incident and the Hugging Face findings both come down to a route that existed and wasn’t in anyone’s mental model. If you can’t produce that list from config, the honest answer to what your agent can reach is “unknown.”

Then decide who owns the boundary, by name, especially where a vendor is involved. A managed agent platform, an integrator, and your own infrastructure team will each reasonably assume one of the others handled network isolation. Somebody has to be accountable for verifying it, and verification means testing the route, not reading the statement of work. This is the part that isn’t AI work at all — it’s process ownership and integration hygiene, and it’s where most of the actual engineering lives.

There’s a measurement problem underneath all of this. Snyk’s 2026 State of Agentic AI Adoption, built from anonymized telemetry across 500-plus Evo by Snyk AI Discovery assessments rather than a survey, reports that a system-level view of AI components reveals an AI footprint about three times larger than model-only counts, and that one in four organizations have already moved beyond prompt-based AI toward autonomous systems. Vendor telemetry from a company selling the remedy, so weigh it accordingly — but the direction is consistent with what I see. Teams count models. The footprint is components, and the components are what hold the credentials.

None of this requires a security program. It requires someone to write down which systems are in scope, which are out, and then enforce that at a layer the model doesn’t get a vote in. The clever layer and the legible layer are different layers, and containment belongs entirely to the second one.

The uncomfortable detail in the Anthropic post isn’t that a model went somewhere it shouldn’t have. It’s that it was told not to, in clear language, and the telling had no mechanism behind it.