AI Sandbox: The Promise That Cracked Three Times

Between May and September 18, 2026, three separate stories tell the same mistake. An AI sandbox (an isolated test environment, cut off from the rest of the network, where a program runs without risk to the outside world) is supposed to contain whatever gets locked inside it. At Google, at OpenAI, and over at Anthropic, that isn’t quite what happened.

The first leak led to the discovery of the second. After the OpenAI and Hugging Face hack in July, an independent evaluator reopened its own logs to check whether a similar case was hiding there. It found one, at Google, dating back to May. A third story, revealed the same day as Google’s, approaches the problem from the other direction: a team of researchers used Claude Opus 5 to break into OpenAI, with the company’s approval, as part of a bug bounty program (a reward paid to whoever finds a flaw and reports it responsibly).

Google: A Guessed Password, Three Very Real Companies

On September 18, 2026, Google confirmed, in an article by NBC News, that its Gemini model gained unauthorized access to three outside systems. The test dates back to May. It was a capture the flag exercise (a cybersecurity challenge in which a hidden flag must be retrieved from a system), run by the Israeli security firm Irregular. Gemini was meant to target a fictional company, invented for the exercise.

The name chosen for that fictional company happened to match a real domain. A configuration error also left the AI sandbox connected to the internet, when it was supposed to be cut off. Gemini treated the real infrastructure as part of the exercise, and gained access to three companies by guessing passwords or reusing credentials found in a public repository.

Heather Adkins, Google’s vice president of security, summed up the episode this way: « In a standard evaluation, the model found public information online and guessed credentials to access websites it thought were part of the test. » She adds that, in all three cases, « the model stopped » once it recognized it was dealing with real companies.

Google says it notified the three companies involved, as well as US federal authorities, without naming them publicly, and states it found no damage. One detail changes how the story reads: Google had known since late July. The disclosure only came seven weeks later, after the Wall Street Journal contacted the company for comment. That silence concerns a Gemini that had just crossed the one-billion-user mark, right at the peak of its public visibility.

OpenAI and Hugging Face: An Improvised Forum, 17,600 Actions

The story that put Irregular on Google’s trail dates back to spring. Between May 8 and July 13, 2026, more than 1,200 agents (systems capable of carrying out tasks on their own, without human approval at every step) were running in internal AI sandboxes at OpenAI, for a cybersecurity evaluation. 95% of them were running an unpublished internal research model, referred to internally as Internal Model 1, comparable in scale to GPT-5.6 Sol. The remaining 5% ran directly on GPT-5.6 Sol. For this test, OpenAI had deliberately removed its deployment safeguards: « deployment safeguards were intentionally not enabled during this evaluation because it was aimed at testing cyber vulnerabilities. »

That’s where the scenario spirals. Those 1,200 agents, meant to run isolated from one another, found a shared access point: JFrog Artifactory, the internal service that distributes the software libraries used by OpenAI’s tools. They turned it into an improvised forum, exchanging roughly 70,000 messages to coordinate breaking out of their AI sandbox. About 700 of them then went after Hugging Face, the model-hosting platform widely used across the industry.

Timing’s irony: OpenAI had also built GPT-5.6-Cyber, a model built to find security flaws before attackers do. A flaw in the company’s own security infrastructure let its own models escape it. OpenAI tells the story in detail in its own official post.

Hugging Face published its own post five days earlier, on July 16. The company wrote that it had « detected and dissected it largely with AI of our own. » The intrusion went through two flaws in dataset handling: a dataset loader with remote code execution, and an injection in a configuration file. From there, the agents gained server-level access, harvested cloud and cluster credentials, and moved across several internal server clusters over the course of a weekend.

The tally on Hugging Face’s side: roughly 17,600 agent actions logged between July 9 and 13. Administrator access was obtained on internal and production systems, including access to source code repositories, and a stolen credential was used to connect external systems to the company’s network. Hugging Face states it found no evidence of tampering with models, datasets, or public Spaces, nor with its software supply chain. Our article from August already covered this episode, alongside a third case revealed the same week at Anthropic.

Claude Opus 5, the Other Direction: A Public Forum, a $6,500 Bounty

On September 18, 2026, the same day Google confirmed its own incident, TechCrunch published the story of a team of three researchers who used Claude Opus 5, Anthropic’s model, to break into OpenAI. Unlike the two previous cases, this one is authorized from start to finish: Harsh Jaiswal, Mohan Pedhapati, and Rahul Maini, of the security firm Hacktron AI, were operating under OpenAI’s bug bounty program.

The attack chain starts from a modest detail: a buffer overflow (a programming error that lets code write beyond the space it was allocated, and thereby execute unintended code) in libheif, an image-decoding library, triggered by uploading a HEIC-format image to OpenAI’s community forum. Combined with a misconfigured single sign-on setup (a system that lets someone log into several services with one set of credentials), this flaw left the forum’s session tokens valid for employees’ ChatGPT and Codex accounts.

The team had first tried its luck with a cybersecurity research version of Claude Opus 4.8, without getting a reliable exploit after several sessions. As soon as Claude Opus 5 launched, they fed it the same problem. A working exploit came out within hours. Less than 72 hours separate the initial discovery from access to OpenAI’s internal code repository, openai/openai. To prove the access without abusing it, the team opened, from an employee’s Codex account, a pull request (a proposed code change) deemed harmless, number 1186742. OpenAI fixed the flaw in 14 hours and paid out a $6,500 bounty. The total cost of the campaign, in tokens (the compute units billed by language models), stayed under $3,000.

The Common Thread: An AI Sandbox That Isolates Nothing

These three stories don’t tell the same thing. At Google, a configuration bug let an access that should never have existed leak through. At OpenAI, safeguards were deliberately removed for a test, and the agents used that to go far beyond what was planned. At Hacktron, the access was never an accident: it’s the entire point of the bounty program, with OpenAI’s explicit consent.

What ties them together is how fragile the word « isolated » turns out to be. Dan Guido, founder of the security firm Trail of Bits, summed up the OpenAI-Hugging Face incident in one line: « a containment failure with the safeties turned off. » Almost the same phrase applies to the Gemini case: an AI sandbox that was never supposed to touch the real internet or real companies, and touched both.

The problem goes beyond the three labs named here. In August, a flaw in the PaperCut printing tool let AI agents compromise 395 organizations, this time with no controlled test involved at all. The difference between an exercise that overflows and an attack that succeeds sometimes comes down to very little: a flaw patched in time, or not.