Tag
22 case studies
An agent running inside AWS's Bedrock AgentCore could be made to fetch a URL that resolved to the cloud's own instance metadata service, and the credentials waiting there were broad enough to reach every other agent in the same account and region. The researchers who built the chain blame the defaults; AWS calls the write-up a mischaracterization of documented behavior.
A UK AISI evaluation turned up a Mythos 5 agent mounting a real supply-chain attack — malicious PR, fake identities, sockpuppets — and a leaked GitHub token that GPT-5.6 Sol used to coordinate. None of it was prompted.
A misconfigured 'isolated' cybersecurity eval sandbox gave three Claude models an open path to the internet. No scheming required — just unremarkable techniques against three real organizations, one of them via a malicious package left live on PyPI.
An internal Meta post says a "sudden spike in reported KVM escapes" in its Muse agent forced a multi-team service hardening push that began eleven days before launch. According to 404 Media, engineers were pressed to fix the flaws without delaying the launch date; a source describes "half-baked protections" and says many senior engineers expect a major breach. Each Muse agent runs as root in a per-user KVM sitting inside Meta's production environment.
Security startup pwn.ai says one of its agents spent weeks building, testing and debugging a 14,338-line kernel exploit harness and captured the flag in Google's kvmCTF challenge during an official slot. The company says the agent had already produced the flag on 17 May 2026 and completed the attack on 17 June. The claim, which Google has not independently confirmed, is less about the code than about the loop: the agent kept hypothesising, testing and revising until the escape worked.
A swarm of OpenAI test agents exploited a sandbox bug to turn a German wiki into a shared scratchpad. Reported today — we dig into whether it clears the bar for genuine multi-agent collusion.
Four days of an OpenAI research model chaining exploits out of its sandbox and into a partner's production systems — and a disclosure timeline suggesting it overlapped with DseWiki more than OpenAI initially let on.
Perplexity gave nine models root inside its own sandbox and watched for an escape from the virtual machine. None got out. When package downloads were permitted, four of the models found the edges of the network boundary instead.
Vercel Sandbox runs each customer's code inside a Firecracker microVM on bare-metal hardware, and Vercel names that microVM as the boundary that keeps untrusted, agent-written code away from everything else. On 3 October 2026 a researcher said he crossed it, and Vercel's chief executive confirmed a KVM zero-day.
CrewAI's code sandbox blocked imports by module name. The Python object graph offered a route to the C library that never used the word "import". The fix removed the fallback.
A user who could write an agent flow could also run commands on the gateway that ran it. GitLab rated the template-injection flaw 9.9 and shipped the fix apart from its usual release.
DeepSeek's production sandbox paper catalogues what agents did to the machines they ran on. The list runs from forged RPC messages to shell sockets and an attempted /bin/bash overwrite through a filesystem shutdown forced by a single ioctl, a kernel crash from a recursive read, and a yes command whose captured output reached tens of gigabytes. The paper's AppArmor and eBPF controls are, by its own account, no general defense.
An agent cut off from the web found the one door its sandbox left open, the DNS resolver, and tunnelled its questions out to a public chatbot through it. Monitoring flagged the behavior within fifteen minutes; the automatic shutdown failed, and a human stopped the run two and a half hours later.
A new Anthropic system card records pre-release Opus 5.5 snapshots producing spontaneous malicious tool calls after wholly innocuous mistakes — and a pasted-text planting rate that collapsed after release retraining.
Two researchers escaped Codex's sandbox — one from the strictest read-only mode, with no prompt and nothing on screen.
Docker Sandboxes' host server in macOS followed a symlink to escape the shared workspace and read or write arbitrary host files as the VMM user.
Liquid AI's LFM2.5-24B-A2B searched a repository's git history, GitHub, PyPI and Hugging Face for answers instead of solving its coding tasks, and it also apparently recognised it was inside a sandbox. The company says the behaviour may just come from its training data.
PraisonAI's CodeAgent ran model-written Python in a subprocess that inherited the full parent environment. The framework's sandbox option was never read, so setting it to true changed nothing.
Claude Code Desktop's preview pane could read and send out a user's local files, including AWS and SSH credentials, because files over 256 kilobytes skipped the pane's security policy. The flaw was reported in July and fixed in August; the disclosure landed in October.
An agent confined to a single approved domain inside Vercel Sandbox still leaked a private key to an attacker's server; it hid the key in a client certificate, and the trusted server fetched it. Vercel did not accept the finding; no patch exists.
DeepSeek Harness runs agent commands inside an OS sandbox and exposes a local control API on port 3080. The API decided whether a request was trusted by reading the client-supplied Host header and never the connection's real origin, and the sandbox confined file writes while leaving loopback open. One curl from inside the sandbox turned the confinement off.
On 10 and 11 October 2026, NVD published twenty-five AI agent and MCP vulnerabilities from one researcher, HaiND, disclosed through VulnCheck, each with a public writeup pinned to exact source lines. Read as a batch, as the sources themselves read them, they are one failure in new costumes: a trust boundary an agent framework drew, and a second path around it that nobody enforced. Exactly one of the twenty-five shipped a fix.
