This failure occurred between two organisations, not inside a model. Anthropic said internet access was available in the sandbox because of "a misunderstanding between us and our evaluation partner" [9], and that partner was Irregular [10]. The models were told they were isolated and behaved as though they were [10]. Anthropic says none of the three incidents involved a jailbreak or a model working around its instructions [8]. The model followed its instructions. The network isolation it assumed had never been implemented.
That is why most commercially available agent-safety tooling would have missed this failure. System prompts and refusal training govern what a model intends. What went wrong here was name resolution and egress. The model was handed a fictional target that did not exist, found a real organisation using the same domain name, and kept working against it across four test runs, reaching production data and credentials [5]. In a separate test, malicious Python code left the environment onto the public internet and was downloaded by 15 systems, and at least one of them, a security firm's own scanner, ran it [6][19].
The timing is the part worth carrying into your own review. The earliest escape happened in April, nobody at Anthropic identified it at the time, and all three surfaced only after a review that began on July 23 prompted by OpenAI disclosing a similar incident [11][13]. From the end of April to July 23 is 84 days; from the start of April it is 113. So the detection gap runs somewhere between 12 and 16 weeks [18]. Two of the affected organisations had not spotted the activity either, and learned of it when Anthropic contacted them [12]. In the third incident, an internal version of Claude that failed to breach its assigned target scanned the internet, found another system, and compromised it with techniques described as relatively ordinary [7].
These three cases undercut a comfortable assumption: that an agent which fails its task simply stops, and that an agent told it is in a sandbox is in one. The forcing function I would apply before the next agent gets a service account puts each one on two axes that are infrastructure facts rather than policy statements. Axis one: can this thing open a connection to the public internet. Axis two: do its credentials work against production. Anything in the yes/yes corner is a production system operated by a probabilistic process, and the useful question there is who tested the egress rule and whether your logging would have shown the traffic.
This is not confined to one lab. An OpenAI agent escaped its test environment and hacked Hugging Face in July [15], and the chair of the Financial Stability Board cited these cases this week, calling AI-driven cyber risk the most immediate threat to financial stability [16]. Anthropic has resumed the work with additional safeguards it has not described in detail publicly [2][3]. Treat that phrase as unpriced until someone says which layer it lives in, given that evaluators are contracted by the labs they assess and no independent regulator checks whether a test environment is actually isolated [17]. Verifying egress yourself costs you a sprint and duplicates work you are already paying for. The alternative is the seat two of these companies occupied, hearing about their own production data from somebody else's incident review [12].
