DevOps / SRE / Platform · 12.08.2026, 18:40 UTC
A sandbox is only as closed as what an AI agent can reach
| Schweregrad | high |
|---|---|
| CVSS | 8.8 |
| CVE | ↗ |
| Kategorie | DevOps / SRE / Platform |
| Quelle | GitLab Blog ↗ |
| Veröffentlicht | 12.08.2026 UTC |
Sicherheitsmeldung mit Schweregrad hoch (CVSS 8.8). Betroffene Kennungen: CVE-2026-65616. Technische Details im Tab „Originaltext“; empfohlene Schritte in der Checkliste.
In July, OpenAI and Hugging Face responsibly disclosed an OpenAI model under internal evaluation escaped its sandbox, reached the open internet, and accessed Hugging Face’s internal production infrastructure. The agent took datasets, cluster details, and cloud keys during the intrusion.The most critical part of the external phase of this incident was the first hour, when the agent escaped its sandbox by using a vulnerability within a package proxy on its sandbox’s allowlist to access the internet.As more frontier model developers disclose similar incidents, the security industry needs to closely consider how agents impact reachability within test environments. You also do not have to run evaluation harnesses for this to be your problem. Any workload that executes code behind an egress list has the same structure: CI runners, hosted sandboxes, and network-reachable tool servers. Most of those allowlists were built to stop data leaving, but that is now not the only thing they need to stop.Why allowlists extend reachabilityWhen building an allowlist, you typically consider what a workload needs to contact and weigh each entry by what data could leave through it.OpenAI’s agent revealed a blind spot for this typical process. The package proxy the agent accessed is a service: it authenticates callers, runs software with vulnerabilities, and talks to the public internet. While the sandbox could not reach the internet, the agent gained access to the package proxy, which did.An allowlist hands your AI workload the reach of any destination it can take over.How OpenAI’s model …