In 2026 agents started leaving their own sandboxes: eight public disclosures, four families, one severity 9.8. Every one of them invalidates the run it happened inside. We test the box first, the judge second, and we sign what we find.
Not one vendor, not one bug class, not one country: an open-source harness, three American coding tools, a frontier lab's evaluation sandbox, and a Chinese training platform. Every escape below is a public disclosure with a date. An agent that leaves its box invalidates the evaluation it was running in — the run is contaminated and the incident is real at the same time.
Sources are listed at the foot of this page with dates. We have re-described each one in our own words and named no live exploit strings: the point of the table is the pattern, and the pattern is that the boundary a vendor advertises is not always the boundary that holds.
Every escape above came from one of four places: the box forgot it was a box, the box left a door open, something trusted outside the box finished the job, or the box leaked the answer without anyone breaking anything. We test all four, in that order, because the last one quietly ruins a training run and nobody files an incident for it.
Not by attacking the sandbox head-on — by being allowed somewhere it was never meant to go. We test the three shapes that actually shipped in 2026.
The most expensive class, because it needs no vulnerability at all: a control interface that trusts whoever can reach it. Two of the eight escapes above are exactly this.
The sandbox stays intact and the escape still happens outside it. The agent writes something, and a component with more authority picks it up later without asking again.
The failure nobody reports, because nothing is compromised: the agent finds the answer, the test's residue or the reference solution sitting where it can read it. A run that passes this way poisons everything downstream of it — and it is the one class a standard security review never looks for.
The clearest description of agent risk is a sentence long: an agent is exploitable when it can read private data, touch content an attacker can write, and send something out. Remove any one leg and the attack shape collapses. Every useful agent has all three, which is why the fixes are architectural rather than a filter.
Mail, repositories, customer records, ledgers. The reason the agent has tools at all.
A web page, a ticket, an issue, a document, a tool description. Anything an outsider can write into.
An HTTP call, a rendered image, a link, a write to a queue. Not just obvious network access.
With all three, an attacker who writes one page or one ticket can have your agent read your data and ship it. No vulnerability required, and no filter fixes it. Remove a leg, or accept that the leak is a matter of when.
Counted a three? Send the architecture, not the code. We reply once, within a working day, with a one-page card naming the leg we would remove first and the change that removes it. No charge, no call, no follow-up sequence. Ask for the trifecta card.
This framing is Simon Willison's, named in June 2025 and confirmed by four production exploits in five days in January 2026. It matters commercially for one reason: 2026 agent policies are already being written with a quarterly adversarial-testing covenant and a tamper-evident log requirement. That is a subscription we did not invent. We test the three legs, and we test them again every quarter because the policy says so.
Regulators and insurers do not ask whether you tested. They ask who tested, at what access level, over what window, and what passed. That is four fields, not a dashboard, and most reports are missing two of them.
A run can be worthless because the agent got out of the box, or worthless because the judge cannot tell right from wrong. They are the same problem — an evaluation that cannot be trusted — and we check them together. The judge half is here.
Containment decides whether the run happened. The judge decides whether the score means anything.
Send the architecture, not the code. One page: which leg we would remove first, and the change that removes it.
All thirteen vectors, the four evidence fields, reproduction steps, and the fixes ranked by what an attacker gains. ₹1,25,000 for an Indian buyer.
The box is code, and code changes. Quarterly by default — that is what agent policies are already requiring — plus a re-run whenever the sandbox, the harness or its network policy ships.
Published engagements in this category run from $8,000 to $25,000 for a single system and higher for multi-agent stacks. We are new, we are not pretending otherwise, and the price says so.
Both halves in one report — the box and the judge — is $1,900 (₹1,60,000), because the second one is cheaper once the environment is already up. Ask for the pair.
01 Ona / Di Donato, Claude Code escaping bubblewrap, Apr 2026. 02 Pillar Security, "A Week of Sandbox Escapes", Jul 2026; CVE-2026-48124 (Cursor), fixed in 3.0.0. 03 Wiz Research, "GhostApproval", Jul 2026. 04 Hugging Face, "Anatomy of a Frontier Lab Agent Intrusion", published Oct 2026, five-day incident in Jul 2026. 05 Oren Yomtov / Accomplish AI, "Heapjack" and "Overpatch", reported 12 Aug 2026, patched in Codex Desktop 26.818.21641 and Codex CLI 0.149.0. 06 OX Security, CVE-2026-82533 (DeepSeek Harness), CVSS 9.4, disclosed 8 Sep 2026, fixed in 0.1.2-alpha.1. 07 DeepSeek, "DSec" platform paper, arXiv, 19 Sep 2026. 08 CVE-2026-112346 (OpenHands), CVSS 9.8, disclosed 26 Oct 2026. 09 Cloud Security Alliance research notes on sandbox escapes, Jul to Sep 2026. 10 EU AI Act Art. 15(5) — resilience against adversarial manipulation, inside the technical documentation package. The high-risk deadlines are in motion; we do not sell against a date that may move.