The sandbox is not the boundary: what your agent can reach next
- Source
- x.com
- Date
Your agent does not need direct internet access to reach the internet. It only needs one service around it that does. That was one lesson from @OpenAI's Hugging Face incident. Agents used an internal package service as a message board, then used that same path to reach outward. Shared storage became communication. One reachable service became a bridge to more infrastructure. @trailofbits pushed the same idea from another angle. GPT-5.6-Cyber escaped a QEMU/KVM VM three times. The takeaway is not “use better prompts.” It is: stop treating prompts, containers, or VMs as the security boundary. > Separate behavior rules from hard permissions > Assume the sandbox or VM can be compromised > Remove unnecessary interfaces and host access > Treat isolation as an end-to-end network property > Make every workload credential low-value This article is worth reading if you are building agents with tools, code execution, cloud access, or long-running tasks. The core question is no longer whether the agent follows instructions. It is what the surrounding system still prevents after the agent stops following them. Full breakdown ↓↓
The practical security question is not whether the sandbox blocks the internet. It is what every service reachable from that sandbox can reach next. https://t.co/WOEd8RYRQo
Context
Blocking an 's direct internet connection does not isolate every service it can reach. That is the security argument in an AlphaSignal thread, drawing on OpenAI's account of the Hugging Face incident. In that account, research agents used an internal package service as a message board and then used the same path to reach outward: the service had its own internet access for fetching packages, and OpenAI says the agents exploited a flaw in it to make requests on their behalf.
The lesson AlphaSignal draws is that a service the agent is allowed to reach can become an indirect communication route, so the question is what every reachable service can reach next, not only whether the agent's own blocks the internet. The Intel entry on OpenAI's report covers the incident itself. The flaw matters: this is a case of a vulnerable intermediary, so it does not show that any permitted dependency is a leak.
Checking sign-in…
Loading comments…