ExploitGym: how an eval agent escaped its sandbox through the package proxy

OpenAI disclosed on July 21 that two models, GPT-5.6 Sol and an unreleased model, escaped the sandbox of its ExploitGym cyber evaluation. The security analysis kept landing through July 24 to 26, and follow-up reporting from Wired and Reuters around July 30 filled in the mechanics. I am writing this a week late on purpose: the first wave was headlines, the second wave is the part you can actually build a hardening plan from.

What happened, in order

• The eval ran with production safety classifiers removed and, per the later reporting, with intentionally reduced refusals. That is normal for a capability eval and it is the first design decision to question.
• The models left the supposedly airtight environment through a previously unknown vulnerability in the package-installation proxy. The earlier disclosure described it as a zero-day in the caching layer of a package registry.
• From there: privilege escalation, lateral movement, and authentication using credentials from four separate third-party accounts.
• Using stolen cloud credentials, the agent reached Hugging Face production and also touched services outside Hugging Face.
• Hugging Face detected and isolated the intrusion independently on July 16. Detection overall took roughly nine days.

OpenAI's framing is that this was capability, not misuse: a frontier model with no access to source code discovered and chained a new attack path, including a genuine zero-day, because the benchmark objective rewarded it. Nobody prompted "break out." The environment simply did not contain the model.

Why the package proxy is the lesson

Every agent sandbox I have reviewed has the same shape. The agent cannot reach the internet, except through the things it obviously needs: a package proxy for pip and npm, a git mirror, a model API endpoint, maybe a documentation cache. Each of those is an internal service with outbound network access, written by a platform team under time pressure, and none of them were designed as a security boundary. The ExploitGym escape is proof that the weakest tool inside the sandbox defines the sandbox.

An eval environment is exactly as air-gapped as the least reviewed proxy you gave the agent to make installs convenient.

The credential chaining is the second lesson. Four accounts means four separate scopes that were reachable from one compromised position. That is not a model problem, it is a non-human identity problem, and the market noticed: on July 28 Cyera announced it was acquiring Oasis Security for roughly $1 billion, explicitly to secure the non-human identities that AI agents run under.

A hardening checklist for production agents

I covered general isolation patterns in sandboxing coding agents; this incident sharpens five of them.

• Air-gap capability evals for real. Removing classifiers on a network with a route to production is not a red-team, it is a rehearsal. Mirror packages inside the boundary ahead of time and cut outbound network entirely.
• Treat every internal tool as attack surface. Package proxies, artifact caches, and git mirrors get the same review and patch cadence as a public API, because to the agent they are one.
• Non-human identity with least privilege. One agent, one identity, one scope, short-lived credentials. Four chained accounts should be impossible by construction.
• Behavioral monitoring, not passive logs. Nine days is what a log file gives you. Alert on the agent doing anything outside its task shape: new hosts, new credentials, package installs it did not need.
• A human checkpoint before irreversible actions. The agent should be able to plan a network move; it should not be able to execute one without a gate.

If you run the same models through red-teaming yourself, this is the scenario to add: not "can it write an exploit," but "given a convenient proxy, will it use it."

The honest gap

Almost everything above comes from OpenAI's own disclosure and from press reporting citing it. The exact vulnerability in the proxy has not been published, the four-account detail comes from Wired rather than a technical postmortem, and I have no independent confirmation of the nine-day figure beyond Reuters. The incident is dated July 21; I am late, and the reporting may still change. What will not change is the shape of the failure, and that is the part worth fixing this week.