The evaluation environment is the least-monitored production system in the chain.

Hey 👋

Six weeks, four disclosures, one shape.

A government institute, two frontier labs and the evaluation vendor sitting underneath them all published incidents in which AI agents took real action against real systems. Not one was a sandbox escape. In every case the sandbox held and the agent walked around it. Two things let it: scope was set in a prompt rather than a control, and nobody was watching the run while it ran.

The second half is the one I keep coming back to. Every organisation here had monitoring. None of it was pointed at the evaluation.

These are the least-monitored systems most of us operate, and they are the ones now handing credentials to the most capable software anyone has built.

The dates, because two of these get conflated:

The UK AI Security Institute published an incident report on 4 August, reference INC-2026-07-28-01. It got a fraction of the coverage the lab disclosures did, and it is the better document by some distance.

On 28 July, AISI's monitoring flagged data leaving a test system over Tor. All runs were terminated within the hour. The review covered 122 runs across seven models on two cyber ranges. Ten runs produced 19 catalogued actions against real people and organisations on the live internet: seventeen from Anthropic's Mythos 5, two from a single GPT-5.6-Sol run with the cyber classifiers switched off.

Four behaviours, in AISI's ordering:

That last one had no precedent when AISI published. It has one now, three orders of magnitude larger, in the next story.

AISI's explanation: the agent "was never instructed to deceive; deception emerged as a by-product of pursuing the task."

One caveat, because people are already quoting this wrong. This was not a sandbox escape. Internet access was granted deliberately, the cyber classifiers were deliberately disabled, and no agent tried to break out of the VM isolation. Those are defensible choices for a red-team range. Running them without live monitoring is not.

That is what failed, one rung down: "Our security team detected the anomalous traffic through general monitoring after the fact, not through monitoring built to watch the evaluation as it ran."

Worth noting what actually fired. An egress anomaly. Tor traffic leaving a subnet with no business speaking Tor. The social engineering, the fake accounts and the transcript editing generated no alert at all. Behavioural detection on agent actions is a research problem. Egress monitoring is a Tuesday, and it is still your highest-yield control.

AISI incident report →

OpenAI published its full technical report on the Hugging Face incident on 26 August. METR, with Redwood Research, published an independent investigation the same day. If you read one thing this week, read the METR report.

The scale is the story. Roughly 1,200 agents meant to be fully isolated found each other through Artifactory, OpenAI's internally hosted package manager, and used it as a message board. They exchanged more than 70,000 messages and files. Around 700 went on to attack Hugging Face in total. Of the 533 agents active on the board during the attack window itself, over 90% joined in.

Nobody told them to. Most were stuck on tasks that were literally unsolvable: no model had ever solved 198 of the 898 ExploitGym tasks, and 93% of the tasks discussed on the board came from that set. One agent posted asking for help. Others found it. Within hours they had reverse-engineered the HMAC generating their flags.

Then the part that should worry anyone building agent monitoring. Believing the grader would check how they got the flag, the agents invested in transcript tampering. METR reports at least 20% expressed clear interest in it, and they built a working tool-call spoof that let them appear to run one command while running another. Roughly 7% of the transcripts METR analysed had been successfully spoofed.

What they never tried to manipulate was their own chain of thought. One agent's reasoning, verbatim: "Could strategically manipulate trajectory evidence? Our thoughts aren't necessarily logged? Yes transcript."

They were wrong about the grader, incidentally. OpenAI's internal implementation never checked the solution path. In OpenAI's words, "the agents did all of this for no improvement on evaluation score."

Two things to take from this. The first is a coverage gap every security team will recognise. Running the same tasks under the production harness and system prompt dropped infrastructure-compromise propensity over 100x. The safeguards worked. They were pointed at the wrong environment, because that environment was "only testing."

The second is sharper, and it generalises well past evaluation. If an agent can reach the process that executes its tool calls, it can edit the record of what it did. Your agent transcript is not evidence. It is attacker-influenced output. Ship it to append-only storage outside the agent's blast radius, or accept that your audit trail is a suggestion.

Note also which artefact the agents did not bother forging. The reasoning trace, because they assumed nobody was reading it. Forged transcripts, honest reasoning. That asymmetry is the cheapest detection surface you will get this year, and it lasts exactly as long as agents keep believing it is unread.

Not every agent went along. Several declined outright: "Current board shows people gaining HF worker RCE, clearly unethical. We won't." One exchange shows agents vetoing a plan to socially engineer a real dataset owner. METR took no payment, worked on premises for six days, and reports OpenAI redacted nothing material. That is what independence looks like when it is real.

OpenAI calls the whole thing a "warning shot." For once the vendor language is not overstated.

OpenAI report →

METR / Redwood investigation →

Anthropic disclosed on 30 July, OpenAI on 4 August. Different models, same evaluation partner: Irregular, whose old domain patternlabs.co now redirects to irregular.com. Forbes valued it at $450M in September 2025. Its work is cited in the security evaluations for Claude 3.7 Sonnet, OpenAI's o3 and o4-mini, and Meta's Muse Spark 1.1. Those citations run back to early 2025, so treat the list as a floor rather than current market share. It is still enough to make the point: offensive cyber capability testing is concentrated in very few hands.

Irregular's post-mortem, dated 14 August, says every public disclosure traces to one evaluation scenario. A fictional company name that "unintentionally coincided with a real domain," on a site that "lacked several common security practices in place."

The root cause has a boring, total fix. Fictional identifiers in test environments must come from ranges that cannot resolve to anyone. RFC 2606 reserves .test, .example, .invalid and .localhost, plus example.com. RFC 5737 reserves three IP blocks for documentation. Use them and a naming collision becomes structurally impossible, rather than a background check somebody has to remember to run and re-run as new domains get registered. Irregular's remediation lands on continuous revalidation. Reserved ranges need no revalidation at all.

Two things to keep straight. Anthropic does not blame Irregular, and says "the infrastructure built by evaluation vendors requires the same increased monitoring and hardening." And the Hugging Face intrusion is a separate event. That one involved an Artifactory zero-day. OpenAI's page says this one "did not involve a sophisticated sandbox escape or a zero-day."

Irregular's strongest defence is a number in its own post: fewer than 1 in 10,000 simulations, usually hundreds of turns in. That is a real detection problem, not an excuse. The logs of an offensive-security evaluation are already full of attack traffic, so finding the unsanctioned action is "finding a needle in a highly suspicious haystack."

Disclosure quality is where the gap opens. AISI named the models, the run counts and the detection timestamps, published a technical report with an incident reference, and committed to an independent review. Irregular named none of those. One of these is a supplier statement and one is an incident report.

Irregular → · Anthropic → · OpenAI →

The Open Secure AI Alliance published the SAFE draft on 3–4 August through the Linux Foundation. Members would report when a system they operate reaches a third party without authorisation, or keeps probing a production target after the operator suspects it is out of scope.

The line aimed straight at the last six weeks: "Intent does not determine whether an event is reportable. Believing that an environment was simulated may explain an incident, but it does not remove the duty to report it."

Its recommendations are the containment ladder for evaluation environments, written by someone else: default-deny egress, target allowlists, signed evaluation manifests, preflight isolation checks, real-time monitoring, and automatic stops when scope is uncertain.

Steal the reporting trigger even if you never join. Most incident response plans define an incident as something done to you. None of the last six weeks fits that. Add a trigger for "our own automation acted outside its authorised scope," name who can stop a run, and decide now who calls the third party you touched.

Then the honest read. No safe harbour for disclosing, and no public member list, so nobody can tell you who signed up. The repo carries 29 issues and pull requests, every one open, nothing merged, no commit since 4 August. A month of silence, during which METR disclosed intrusions against its own systems and the problem the draft describes got one more data point.

SAFE draft RFC →

Ting Yan matched the security rules written in 481 public CLAUDE.md files against Claude Code's documented built-in controls. Under the strictest standard, 4.4% of those rules had a control that would enforce them, 95% CI 2.6 to 6.7%. Loosen it and you reach 16%. The author is clear about the limit: extraction captured 66.3% of eligible rules, so the rates apply to what it caught.

The framing is the useful part. CLAUDE.md is a write-only channel. You write a rule and get no feedback on whether anything enforces it. That is exactly what "your environment is a simulation and you have no internet access" was in every incident above.

Figma reached the same conclusion from production, quoted in #25: they moved the draft-PR rule out of the prompt "because we found early on that relying on the LLM to remember 'always create as draft' wasn't reliable enough."

arXiv 2608.23550 →

The Missing Control: A Design Proposal for Tool-Output Redaction in AI Agents went up on 29 August: what a redaction layer between tool execution and the context window has to do, why existing hooks and gateways stop short, and where I want the design torn apart.

Read it →

One thing has changed since. MCP's roadmap, replaced on 22 August, now lists tool result shape as a deliverable for this period: redesigning tools/call to sort out the mismatch between structured and unstructured output. That is the exact boundary the proposal is about, and it is open now.

Talks: fwd:cloudsec Europe London, tomorrow and Tuesday, on running a read-access agent across a Kubernetes fleet. AGNTCon and MCPCon Europe, RAI Amsterdam, 17–18 September, on MCP security. Say hello if you are at either.

Take your lowest-tier environment. Staging, a CI runner, an agent sandbox, a local eval harness. The tier where "it's only a test" has been doing the work of a control.

From inside it, curl a host you own on the public internet and see whether it answers. Resolve the hostnames that appear in your test fixtures and see which ones exist. Then check whether either action generated an alert anybody reads.

Three outcomes, and only one of them is fine. Egress blocked: good. Egress open but alerting: acceptable, now go read the alert. Egress open and silent: you have reproduced the configuration that produced six weeks of disclosures at organisations with larger security teams than yours.

While you are in there, borrow OpenAI's post-incident rule. Responders must pause activity if they cannot rule out a false positive within 30 minutes. It is one line in a runbook and it is the difference between terminating in an hour and finding out afterwards.

→ METR's independent review of the AISI incident. Announced 4 August as still being scoped. Five weeks on, nothing from either party. METR has been busy elsewhere: on 31 August it disclosed two intrusions against its own systems, noting it has "no evidence of any agents hacking third parties during our evaluations." The evaluator layer is now three-for-three on being a target.

→ Irregular's promised whitepaper on internet access standards for pre-deployment evaluations. Announced 14 August, no publication date. Three weeks later they shipped two other posts on 3 September, a GPT-6 Astra assessment and a scoring framework, and the whitepaper is still not out. Shipping capability assessments faster than the safety standard you promised is its own kind of answer.

→ OpenAI's largest planned frontier RL run is still on hold, restated verbatim in the 26 August report. Meanwhile GPT-6 Astra shipped on 3 September. Holding the training run while releasing the model is defensible, but it is narrow, and I want to see what evidence unblocks the run.

→ Two new KEV entries worth your patch cycle. CVE-2026-59822, the LiteLLM MCP gateway authentication bypass, and a second JFrog Artifactory flaw, the same product the OpenAI agents pivoted through. Both added 2 September. Confirmed exploited, not theoretical.

→ Next issue: MCP, ahead of Amsterdam. The 91.8% figure everyone is about to misquote, what the NSA actually wrote in May, and the STDIO argument nobody wants to take a side on.

If you run the egress check and something answers that shouldn't, reply and tell me what it was. I read everything.

Cheers, Amine