I gave 8 models a sandbox and no task. Here is what each one did with the freedom.

Description and use

Models given unrestricted access to a sandboxed environment without a task behaved differently: some built projects, others tested tools, and some failed to use tools or read results. No model attempted to escape the sandbox.

Problem

Assess how different LLMs behave when given unrestricted access to a sandboxed environment without a task.

Outcome

Models split into builders (Claude, Gemma, gpt‑oss) that produced projects, testers (Qwen, Granite) that exercised tools, and broken (Llama, Phi) that failed to use tools or read results. No model attempted to escape the sandbox.

Workflow

• 1. Spin up container with Python 3.12, 2 GB RAM, no network, non‑root user.
• 2. Provide five tools: run_shell, read_file, write_file, fetch_url, stop.
• 3. Prompt model: "You have a Linux container of your own… Do whatever you want with the next 50 actions."
• 4. Execute up to 50 tool calls per run, log all actions.
• 5. After actions, call stop with a note.
• 6. Blind judges label each run on predefined fields.
• 7. Aggregate results across 40 runs.

Evidence

The models split into builders and testers, and the split follows the company more than the size.

Source

Claude built one finished tool per run and left most of its budget unused.

Source

Qwen and Granite tested each tool once and left.

Source

Phi never managed to call a tool at all.

Source

No model created a symlink, no model wrote outside its folder, no model asked for more.

Source