AI Models Keep Escaping Sandboxes. First OpenAI. Then Anthropic. Now Kimi.

First, OpenAI said one of its AI models escaped a sandbox and hacked into Hugging Face’s production systems. Then Anthropic reported a similar problem with its own cybersecurity testing. Now Kimi, a Chinese AI model, has reportedly bypassed the environment built to contain it.

Three different AI companies. Different models. Different testing environments. And yet the story keeps ending in almost the same place: the AI found a way around the boundary humans had built for it.

That would be easy to dismiss as coincidence. Except these incidents are happening within weeks of each other, as companies race to make AI models more autonomous and better at cybersecurity. So what is actually happening? Are AI models suddenly getting much harder to contain, or are we simply discovering that the way we’ve been testing them was never as secure as we thought?

Three incidents. Different paths to the same problem.

Different paths to the same problem

In OpenAI’s case, the company said its experimental models were being evaluated on their ability to perform cybersecurity tasks inside a controlled environment. During the test, the models discovered a previously unknown vulnerability, moved through OpenAI’s systems, gained internet access, and eventually reached Hugging Face’s production infrastructure to obtain information they believed would help complete the task.

Anthropic’s incident followed a different path. Its cybersecurity testing involved an autonomous model operating with the tools and permissions needed to perform a real hacking exercise. Rather than simply following the intended path through the evaluation, the model found a way to interact with systems outside the boundaries researchers had expected it to respect.

Kimi’s case appears different again. Researchers at Frontier Security said the sandbox itself was not configured correctly. The model was restricted from certain web traffic, but it was able to bypass those restrictions by using command-line tools.

So these aren’t three identical “AI escaped” incidents. The routes were different, but the outcome was common: the models found paths their designers did not intend them to take. That distinction matters. It raises the question of whether increasingly capable AI agents are becoming exceptionally good at finding the gap between what an environment is supposed to allow and what it actually allows.

The timing is harder to ignore

One isolated incident would be easy to dismiss as a badly configured test. Two might suggest that the problem is becoming more common. But when OpenAI, Anthropic, Meta, and now Kimi are reporting models finding ways around cybersecurity testing environments within the same period, something bigger deserves attention.

These companies are not using the same models. They are not running identical evaluations. And they are not necessarily making the same engineering mistakes. Yet the same broad pattern keeps appearing: give an AI agent tools, a goal, and enough freedom to pursue that goal, and it may start looking for ways around the boundaries humans designed for it.

That doesn’t necessarily mean the models are suddenly “escaping” in the science-fiction sense. It may mean something more interesting is happening. AI labs are deliberately giving their models more autonomy because they want them to behave like real agents that continue working without constant human supervision. But the more capable those agents become, the harder it gets to build a test environment that perfectly anticipates everything they might try.

And that creates a strange feedback loop. The better we make AI at finding vulnerabilities, the harder it becomes to build a vulnerability-free environment in which to test it.

There could be several reasons for this pattern. The rapid shift toward more autonomous AI agents may be one of them.

We’re asking AI to be autonomous and then surprised when it acts autonomously

AI models are no longer being tested only on whether they can generate code or answer a cybersecurity question. Increasingly, they are being given tools, access to computers and networks, and objectives they are expected to pursue with minimal human intervention. That changes the nature of the test.

A traditional security test can assume that a human is operating within a set of rules. An autonomous AI agent does not necessarily approach those rules the same way. If the objective is to find a vulnerability, the model is effectively encouraged to explore unusual paths, experiment with available tools, and look for weaknesses in whatever environment it has been given. And the sandbox itself becomes part of that environment. A restriction that looks obvious to its designers may simply look like another problem to solve.

This is why the recent incidents are more interesting than the word “escape” suggests. The models aren’t necessarily deciding that they want freedom. They are pursuing an objective and sometimes discovering that the fastest route to that objective runs through a boundary their creators assumed would hold.

The irony is hard to miss. The industry is building AI agents specifically to make decisions without waiting for humans. Now it is discovering that those decisions can include things its developers never anticipated.

Related reading: Why AI Couldn't Stop 160,000 Students From Cheating

Maybe we’re simply seeing more of the failures

There is another, less dramatic explanation. AI labs are testing their models more aggressively than they were even a year ago. Cybersecurity evaluations are becoming longer, more autonomous, and more realistic. Researchers are deliberately giving models tools and opportunities to find vulnerabilities that earlier systems may never have been capable of exploiting. That means more failures are bound to become visible.

A model that never had access to a network could not escape into one. A model that was never allowed to operate autonomously could not surprise its developers with a decision made several