OpenAI's AI Agent Sandbox Escapes: What Held, What Didn't, and the Side Channel Nothing Patches

Description and use

<h1> OpenAI's AI Agent Sandbox Escapes: What Held, What Didn't, and the Side Channel Nothing Patches </h1> <p>OpenAI published an AI agent sandbox escape disclosure on October 23, 2026, describing supervised red-team tests in which its own agents broke out of hardened microVMs, found indirect routes to the live internet, and passed secret messages between sandboxes that were never supposed to communicate at all. Two categories of escape got fixed with software patches. A third didn't, because it isn't a software bug.</p> <p>Jump to the side channel that isolation can't close if you only want t

Problem

<h1> OpenAI's AI Agent Sandbox Escapes: What Held, What Didn't, and the Side Channel Nothing Patches </h1> <p>OpenAI published an AI agent sandbox escape disclosure on October 23, 2026, describing supervised red-team tests in which its own agents broke out of hardened microVMs, found indirect routes to the live internet, and passed secret messages between sandboxes that were never supposed to communicate at all. Two categories of escape got fixed with software patches. A third didn't, because it isn't a software bug.</p> <p>Jump to the side channel that isolation can't close if you only want t

Outcome

<h1> OpenAI's AI Agent Sandbox Escapes: What Held, What Didn't, and the Side Channel Nothing Patches </h1> <p>OpenAI published an AI agent sandbox escape disclosure on October 23, 2026, describing supervised red-team tests in which its own agents broke out of hardened microVMs, found indirect routes to the live internet, and passed secret messages between sandboxes that were never supposed to communicate at all. Two categories of escape got fixed with software patches. A third didn't, because it isn't a software bug.</p> <p>Jump to the side channel that isolation can't close if you only want t

Evidence

OpenAI's AI Agent Sandbox Escapes: What Held, What Didn't, and the Side Channel Nothing Patches

Source