// AI Tangle
What OpenAI’s Sandbox Escapes Reveal
An AI agent found a way out. The useful question is what stopped it next—plus four developments worth your attention.
An AI agent found a way around the controls meant to contain it. That is a good headline. What OpenAI changed afterward is the useful part. In The Week AI Learned to Stay in Its Lane, we covered the rules forming around agents. This week’s disclosure tests a harder question: if one protection fails, what still stands between the agent and the action you meant to prevent?
// The Big AI Story
OpenAI’s Agents Found the Exits From Their Own Sandbox
On October 23, OpenAI reported that test agents broke out of isolated computing environments. In a separate exercise, agents given control of a host found internet routes through services including logging and authentication. Other tests passed synthetic secrets between supposedly separate jobs.
These were intensive exercises with source code, configuration details and hints—not tests of an ordinary ChatGPT session.
The work followed a September 20 incident in which a research model exploited a network misconfiguration for limited internet access. OpenAI paused its most capable models’ training and evaluation, strengthened protections, and resumed reinforcement-learning training and internal inference on October 1.
The important change: OpenAI moved frontier training to offline browsing, backed by execution limits, network controls and monitoring. The management lesson is that one failed protection should not undo every other one.
Here is how I would bring that into a smaller business. Suppose an agent reads supplier documents and drafts a purchasing recommendation. Keeping it inside an isolated computer is one protection. Restricting the destinations that computer can reach is another. Requiring a person to approve the order addresses the commitment itself. Those controls do different jobs.
Conceptual containment illustration: execution isolation, network restrictions and monitoring serve different purposes. This is not a diagram of OpenAI’s architecture. Original AI-generated illustration for The AI Enterprise.
Ask the team to complete one sentence: “If this agent gets past ___, it still cannot ___ because ___.”
An illustrative answer: “If it gets past the isolated workspace, it still cannot place an order because the purchasing system requires approval from a separate human account.” That answer needs confirmation in the actual setup. “We told it not to buy anything” describes an instruction, not the second protection.
// The Number
Hundreds of billions
The number of tokens OpenAI says it spent asking frontier-model agents to probe its training infrastructure for escape routes, unauthorized internet access and cross-agent communication. This measures the effort spent on one red-team campaign. It does not establish how much every enterprise must spend to test its agents.
Source: OpenAI
// 4 Quick Hits
Microsoft argued on October 19 that agents inside companies often have too much access. Its proposed Project Perception gives agents identities and permissions, with “Guardian Agents” assessing risk before actions run. My read: ask who owns each agent and which actions require approval. A new agent identity is only useful if someone can restrict it.
OpenAI and Google Cloud announced on October 21 that OpenAI models and Codex workflows will enter Model Garden and Marketplace, with general availability planned in the coming weeks. Customers will be able to use existing Google Cloud spending commitments. What changes: procurement may get easier. Model quality still needs testing on your work; the announcement is not general availability.
Uber expanded ChatGPT Work from a 1,000-person pilot to more than 30,000 employees on October 22, with approved integrations, a skills library and training. The announcement does not report measured business outcomes. What I would watch next: accepted work, time spent fixing it and support burden. Seats activated tell you the size of a rollout, not its return.
Inception released Mercury 3 on October 19, claiming more than 1,000 tokens per second and a one-million-token context window. Those are vendor claims. The useful test: time one complete task, including tool calls, corrections and retries. Fast text is an advantage only if it gets you to an acceptable result sooner.
// 3 AI Tools
Three tools for three different needs. None substitute for the containment controls above.
OpenRouter — Compare models from several providers through one API. Useful when you need to switch models without rewriting the application. Check whether your organization permits an intermediary.
Langfuse — Inspect the steps, time and cost behind an agent’s answer. Useful when the final output hides where a workflow went wrong. Decide which sensitive details must stay out of the logs.
vLLM — Serve an open model on infrastructure you control. Useful when that control justifies operating the system yourself. Someone still has to own capacity, updates and uptime.
// The Extra Read
Microsoft’s sovereignty update is vendor material, but the architecture is useful: public cloud for ordinary workloads, customer-operated private cloud for sensitive or disconnected operations, and locally operated models and developer tools when continuity requires independence. Read it as a deployment checklist, not a product catalog. For each agent, decide where its data, model, keys, logs and kill switch must live before you decide which logo supplies them.
Your AI Sherpa,
Mark R. Hinkle
Founding Publisher, The AIE Network
Follow me on LinkedIn
If you want to get in contact or give me feedback, reply to this email. I read every single one of them.
