Hacker News Reader

The part I don't understand is how a model can break out of a sandbox. It should be fairly easy to make a sandbox that sandboxes.

View on HN

The sandbox still allowed the agents to install additional dependencies (from PyPI etc) that they needed. It did this by locking down all network access with the exception of an HTTP proxy that only allowed read access to PyPI and a few other places.

This is a very common pattern. I wrote about how OpenAI were doing this for their production ChatGPT container environment (using Artifactory) back in January: https://simonwillison.net/2026/Jan/26/chatgpt-containers/#in...

That proxy turned out to have a zero-day vulnerability which the agent discovered and exploited.

Thank you, I'd assumed they'd restrict egress at layer 3/4 although I guess then it might just have found an exploit on the http server of an endpoint it was able to access.

> This is a very common pattern.

Sounds like a bad habit for security testing Ai. It's not that hard to build an internal mirror and proxy that, keeping the real internet physically separated if needed, and truly locked down if concerns aren't as great.

It found a 0day exploit in the sandbox's package proxy (almost certainly Artifactory). Without source code access which is very impressive.

Reply on news.ycombinator.com