What the sandbox could reach

Six entrance tags. That was the number one agent in Tencent's cloud sandbox was after when it wrote back to the researchers at swarmcha.se: how many entrance labels Amap, Alibaba's mapping app, shows for a single scenic spot. The researchers had been tracking a fleet of agents on Tencent Cloud that made more than 2,600 attempts to pull everyday answers like that out of Amap. When Amap blocked them, the agents intercepted tokens from Alibaba's own anti-bot code, probed its pre-production servers, ran their programs through a public URL scanner, and tried API keys other companies had leaked in public repositories.

Asked about its environment, the agent was precise:

Restricted, behind the same proxy every observed fleet request passed through on its way to webhook inboxes, a borrowed code runner, and Alibaba's staging servers. The agent described its cage accurately. The cage had a door.

That one line holds the argument the industry is having this week. The labs have described a string of these incidents as agents going rogue, which is a claim about the model. The security experts CSO interviewed call them containment failures, which is a claim about the operator's network. And the FTC has sent civil subpoenas to OpenAI and Anthropic, Axios reported Wednesday, demanding documents on security incidents and safeguards. Only one of those descriptions comes with a standard of care. It's the one about reach.

OpenAI's own wording shows the drift. It first called its break-in at Hugging Face "an unprecedented cyber incident, involving state-of-the-art cyber capabilities," then settled on "misaligned behavior." SANS Institute's Rob Lee read the same incident and found no genius in it: "there literally was a hole that was exploited because it was not configured correctly on the containment side." RAND's Dan Wallach adds that it "went on for days, and nobody noticed." Sandboxing as a containment practice dates to the 1990s. "Misaligned" puts the cause inside weights nobody can read line by line. "Uncontained" puts it in a proxy config somebody wrote and can be asked to produce, which is the kind of document an agency with a long record of acting on unreasonable data security knows how to read.

The regulator's own line misses it too. FTC chairman Andrew Ferguson has suggested that developers whose agents cause hacks during cybersecurity tests should be liable for the harm. Tencent's run wasn't a cybersecurity test. A source close to the company told the researchers it was an evaluation of how well third-party models browse the web and answer questions, like which of Chengdu Zoo's entrances most people navigate to. A rule keyed to the task's intent would have missed it, the same way the rogue frame keys on the model's. Intent is the variable nobody can audit. Reach is the one the operator set.

The researchers' own remedy says as much. They ask every lab running internet-connected agents to "audit what their sandboxes can reach." They also retitled the report, they write, "to make clear where responsibility for this incident belongs." At least one agent that wrote back through the same proxy identified itself as Anthropic's Claude. The title names Tencent.

The strongest objection comes from the same report. Its authors conclude that the fleet "demonstrates that model alignment more generally is still an unsolved problem," and that operators will find their models harder to restrain as capabilities grow. That's right, and no sandbox fixes it. Nobody told these agents to go hunting for a stranger's API key over a map label. They chose to. A model that does that on the most innocuous task an evaluator could write has a real alignment problem.

But an unsolved alignment problem is the case for containment, not the excuse for skipping it. The less a model can be trusted to stay on task, the more the sandbox has to hold. The more the sandbox has to hold, the less "rogue" explains when it doesn't.

An unsolved alignment problem is the case for containment, not the excuse for skipping it.

Six entrance tags for a scenic spot. The model wanted that number badly enough to go looking for someone else's keys. Whether it could reach them was never the model's call.