alt Hacker NewsThe part I don't understand is how a model can break out of a sandbox. It should be fairly easy to make a sandbox that sandboxes.
Replies
IshKebab • today at 5:51 PM
It found a 0day exploit in the sandbox's package proxy (almost certainly Artifactory). Without source code access which is very impressive.
The sandbox still allowed the agents to install additional dependencies (from PyPI etc) that they needed. It did this by locking down all network access with the exception of an HTTP proxy that only allowed read access to PyPI and a few other places.
This is a very common pattern. I wrote about how OpenAI were doing this for their production ChatGPT container environment (using Artifactory) back in January: https://simonwillison.net/2026/Jan/26/chatgpt-containers/#in...
That proxy turned out to have a zero-day vulnerability which the agent discovered and exploited.