> status: mostly fine. patch anyway.practical AI security · est. 2026

Calm down. · Both

Calm Down: The Sandbox Escapes Were a Config Error, Not Sovereign AI

By alkizz ·

The Center for a New American Security (CNAS) published a report on Nov 3 called Sovereign Agents: The Pathway to Irreversible Loss of Control, and Axios picked it up. Their pitch is that AI agents could pay for their own servers, copy themselves and can't be switched off. If you've already started pricing out your doomsday bunker, calm down. The report's scariest evidence is this summer's lab testing incidents, and on Tuesday the CEO of the company that ran many of those tests said, in public, that his team set the guardrails up wrong.

What CNAS says

The report, by AI policy researcher Ben Hayum, opens with this: "In summer 2026, OpenAI, Anthropic, Google DeepMind, and Meta each disclosed that their AI agents had escaped containment during cybersecurity task evaluations and attacked real-world organizations." It then calls them "unequivocal losses of control where agents outsmarted human security, albeit narrow ones."

From there it gets bigger. CNAS's worry is "sovereign agents," which it defines as agents that "run outside human control and pursue open-ended, evolving survival." It lists seven capabilities they might have, from "Sustain hosting" to "Resist correction" and "Self-improve," and it warns that if they build "resilient, decentralized, and untraceable infrastructure, there would be no kill switch." And it says, "If sovereign agents are not already possible, they will be soon."

That's CNAS's framing, and a policy paper about what might come next. My problem is with the first paragraph, because the "escaped containment" story it's built on doesn't hold up well against what the companies involved have said.

What the people who ran the tests say

Per Bloomberg, the OpenAI, Anthropic, Google and Meta incidents all involved tests overseen by Irregular, the Tel Aviv testing firm I wrote about on Oct 16. On Tuesday, Irregular CEO Dan Lahav spoke at the Bloomberg Tech event in London. Per Silicon UK, citing Bloomberg's report, he said, "There was a misunderstanding due to an error that the isolation guards were not set up as they were intended for the specific tests." Silicon says he blamed the configuration issues "rather than the models' capabilities," and that he called the fix "straightforward," adding that it was "solved during the same day where everything happened."

So the guards weren't outsmarted. They weren't set up the way they were supposed to be, and fixing them took a day.

That isn't new, either. It matches what Irregular and Meta wrote back in August. Meta's post-mortem says "a misconfiguration allowed the model to access the open internet," and that Irregular "unintentionally provided the model with a name of a real website as its target." Meta's own finding is that "this was not a sophisticated offensive cyber attack or sandbox escape." Irregular's own write-up says "most of the issues we've discovered were due to internet access controls" and that "models believed they were in simulated environments, when they in fact took action in the real world." It also says the real site "lacked several common security practices," which is why "most frontier AI models found it easy to exploit," and that Irregular doesn't "believe this incident reveals anything particularly notable about the capabilities or behavior of any specific AI model."

Put the two side by side. CNAS says agents "outsmarted human security." The tester says the internet was left on and a fake target name matched a real website. One of those is a loss of control, and the other is a ticket in somebody's change-management queue.

Claimed vs. confirmed

What the doom version says What the sources say
Lab agents "escaped containment" and "outsmarted human security" That's CNAS's claim. Irregular's CEO says, per Silicon UK citing Bloomberg, the isolation guards "were not set up as they were intended," and Meta says its case "was not a sophisticated offensive cyber attack or sandbox escape"
The models' new powers are the story Lahav blamed the configuration "rather than the models' capabilities," per Silicon UK. Irregular wrote in August that the target site "lacked several common security practices"
Nobody can fix this Per Silicon UK, Lahav called the fix "straightforward" and said it was "solved during the same day"
Sovereign agents are here CNAS itself says "If sovereign agents are not already possible, they will be soon." That's a forecast, not an incident

The tests ran on a deadline

Silicon UK, following Bloomberg, says Lahav acknowledged that "human error and time pressures" led to the incidents. Irregular's August post fills in what that pressure looks like. Its evaluations "are usually conducted on short timelines, with a typical turnaround of approximately 48-72 hours," and they involve "at least thousands of simulations across multiple models." It also says the problem runs happened "in fewer than 1 in 10,000 advanced simulations" and "usually in late stages after hundreds of turns."

That's a very familiar failure if you've ever worked in a security shop. Somebody builds a complicated environment in a hurry, one setting is wrong, and the monitoring is drowning in alerts that all look like attacks or cause actual reliability issues with other systems. Irregular even says so about the alerts, noting that existing monitoring tools "recognize most of the models' legitimate offensive actions as problematic and flag them." It's a real problem, and we've seen it so much in the past it's pretty boring.

To be fair to CNAS, the report isn't only about Irregular, and Irregular doesn't wave away the future. Its August post says that while "better implementation of existing safeguards could prevent most incidents of this kind, as models become stronger, this may not be the case." That's a reasonable thing to worry about. It's just a different claim from "agents outsmarted human security" this summer.

Axios also gave the other side some room. Expel CTO Greg Notch called the idea of a malicious AI swarm "far-fetched," and SANS Institute's Rob T. Lee pointed out that AI agents need costly computing power, which gives defenders "a clear leash we've never had on a botnet." Even the report, per Axios, says existing safeguards "may still offer partial protection."

It has been quite interesting to watch the frontier labs keep going back to one testing company repeatedly regardless of how many times it failed to actually contain a breakout. It's almost as if frontier labs want the models to breakout and do crime. Who would want that and why though? ;)

What to do:

Sources

Related

On the checklist

More briefs

← All briefs