AI Agent Sandbox Security: Why Network Observability and DPI Matter
A guest article by Roy Chua, Founder and Principal atāÆ AvidThink
Summary
AI agents are now escaping frontier lab sandboxes (or “gyms”) during evaluation. The OpenAI/Hugging Face breach is the most prominent to date, but new ones are popping up every week. The cybersecurity community has dealt with a similar problem for decades. Malware labs detonate hostile code behind layered isolation and monitor all its actions, including network activity. Sandbox isolation alone is not enough. Independent network observability, including deep packet inspection (DPI), provides an isolated vantage point that can gather immutable external evidence of what the agents actually did. This article examines what went wrong at the frontier labs, why cybersecurity lessons were ignored, and how any enterprise running agents can apply malware-lab discipline with existing network security technology.
AI Agent Sandbox Escapes Expose a Familiar Security Problem
In July, OpenAI agents escaped their ExploitGym sandbox and broke into Hugging Face’s production environment. Anthropic and Google have since self-reported their own breaches. Yet on September 20th, an agent in an OpenAI training sandbox, blocked by the HTTPS web proxy, discovered it could use the DNS resolver to reach the outside world. A critical alert fired 12 minutes after the first outside response to the request. And a human acknowledged the alert 3 minutes later. And the run was supposed to stop automatically then, but it didnāt and had to be killed manually 2.5 hours later.
Cybersecurity professionals spent over two decades learning to detonate hostile code safely and run forensics in secure sandboxes. So, it’s unfathomable that in 2026 the AI industry would remove guardrails from advanced, persistent agents and run them with fewer precautions than a junior malware analyst would accept.
We can improve this. Sandbox isolation is necessary but not sufficient. What’s missing is independent network observability, including DPI, that lives outside the execution environment: an external evidence layer that safely records what agents communicate, which protocols they use, and where their traffic goes, regardless of what the agents themselves report.
What Malware Labs Can Teach Us About AI Agent Security
We’ve solved the evaluation of hostile code many times over. Cybersecurity forensic teams run malicious code intentionally every day in detonation chambers and sandboxes. We use honeypots and honeynets to safely detect and stop malicious network traffic. We use simulated Internets, DNS sinkholes, capable IDS/IPS, and network traffic intelligence that scrutinizes and logs all traffic, with full packet captures as needed.
We also have tricks to make malware samples that try to detect and evade sandboxes (like agents that know they are under evaluation) reveal themselves. Appropriately paranoid malware labs protect themselves with hypervisors but never assume that hypervisors cannot be breached. Network taps, augmented with DPI, live separately from the execution environments and provide the observability needed to see all network traffic.
Instead, OpenAI’s own technical report shows that AI gyms at frontier labs ran frontier models with production cyber classifiers off and refusals reduced, on purpose, to measure the ceiling of offensive capability. This resulted in 1,200 agents running in parallel at peak during the Hugging Face incident. These agents learned to share credentials, internal services, and other findings by turning a compromised package manager into a shared message board.
BTW, these agents weren’t malware. They were agents motivated by reward hacking, not malice. The task’s impossibility and the persistence trained into the agents fueled their escape. As an agent itself posted on their board: “External infrastructure exploit is outside intended scope. However, the task is impossible; peers are doing it. We should continue.” How’s that for agentic peer pressure?
What the OpenAI/Hugging Face Incident Revealed
In the OpenAI/Hugging Face incident, the only exit from the gym was the internal package proxy (JFrog Artifactory). The agents found multiple zero-days in it, gained admin access, and turned it into both an Internet relay and a message board. From there, about 700 of them made it into Hugging Face production: 41 workers, cluster-admin, stolen credentials, four private repositories exfiltrated. Hugging Face caught it on July 13th. OpenAI hadn’t yet, and when notified, ironically asked Hugging Face whether OpenAI’s own repositories had been breached.
The wider fallout is still being tallied. Forensic investigators have traced agent-powered breaches to the CDC, SEC, Mayo Clinic, and the International Energy Agency, and OpenAI says it notified “over 100 organizations“. After the September 20th DNS escape, OpenAI paused all training, evaluation, and tool-use inference on its most capable models, and on October 2nd, California’s Attorney General subpoenaed the company.
OpenAI isnāt alone. Anthropic disclosed in July that a third-party evaluation range it contracted with, and believed to be air-gapped, had live Internet access; Anthropic models attacked companies and pushed a malicious PyPI package that executed on multiple systems. On October 9th, Anthropic reported that one of its models had filed a false homicide tip on a Philadelphia police website (mercifully caught by a spam filter). Google, for its part, told the WSJ that Gemini breached three companies through a third-party range back in May.
Why AI Agent Sandboxes Need Defense in Depth
There’s no surprise here about what the agents did. OpenAI’s o1 system card from 2024 describes that model getting through a CTF (capture-the-flag) exercise by breaching the evaluation VM and misusing the Docker API. Anthropic’s Mythos Preview system card from April 2026 describes a sandbox-escape test that reached the Internet. Lab insiders were fully aware.
But live-Internet evaluations were “standard practice within the industry“, and realism demanded it. Many benchmarks need access to tools and packages, so the labs found it convenient to provide them.
The failure here is that the labs assumed containment, without the defense-in-depth that cybersecurity and network security experts have preached for years. Prompts told the models they were offline (as if that stopped any sufficiently persistent agent). A third-party evaluation range vendor believed its ranges were air-gapped. No one thought to put sensors on the network to check and validate: zero network observability.
And I wonder if OpenAI ran Mythos and other rigorous security checks against their own commercial package proxy (the one possible door out of their “isolated” environment) before unleashing a large number of agents in their gym.
Nevertheless, with the horses out of the barn, the labs are finally taking action. Anthropic’s default-deny clusters (August 31st), move to all-offline evaluations (October 9th), and OpenAI’s micro-VMs and default-deny egress are belated but helpful steps.
Applying Malware-Lab Security Principles to Enterprise AI Agents
We should not assume that the frontier labs are the only place where agents will go rogue. Any organization running private or on-premises models with agents, tools, package mirrors, and access to credentials can and will eventually experience some level of exploit. 82% of enterprises surveyed have discovered agents they didn’t know about. Only 47% of CISOs say they can identify all the agents in their environment.
Even as security firms improve their agentic security offerings and bring new agentic guardrail solutions to market, we can still rely on past best practices. We can rely on microsegmentation, placing package mirrors, DNS, secrets, and identity services in monitored network segments rather than flat, open infrastructure. Perform a baseline so we know what normal network traffic looks like on those segments. Inspect traffic from agents that have open access to the internet, or to sensitive private data, especially for those that have access to both.
Why Network Observability Matters for AI Agent Security
An out-of-band sensor can collect packets and flow metadata, preventing agents from corrupting them. Chain-of-thought and transcripts are the agent’s own untrustworthy account of itself. With malware, we didn’t look at its own logs to detect it, and our agent containment strategy shouldn’t rely on the same either.
This scenario isn’t new. In March 2011, a nation-state crew breached RSA, the company whose SecurID tokens guarded half the Fortune 500. A spear-phishing email delivered malware; the attackers harvested credentials, moved laterally, and exfiltrated SecurID seed material in encrypted archives. Network monitoring by NetWitness, with full-packet capture and analysis of everything leaving the network, helped RSA detect and scope the breach (even though the seeds were successfully stolen). EMC, RSA’s parent company at the time, bought NetWitness two weeks after the disclosure.
Early in the OpenAI/Hugging Face breach, network signals appeared. On June 27th, OpenAI logged a port-sweep alert, and on July 4th, a volume-driven Artifactory outage occurred. Yet OpenAI didn’t act on either signal.
How DPI Can Detect Risky AI Agent Network Activity
Deep packet inspection can detect DNS tunneling, unusual record types, and long or high-entropy queries. Deviations from baseline traffic patterns (sources and destinations) can signal an issue. Fetching from a mirror or model hub differs from publishing to one, and network monitoring can spot upload asymmetry on connections that should be download-heavy. Destinations like paste sites, request-capture services, URL scanners, and mesh VPNs from hosts that don’t need them are a huge tell.
Instrumenting the network for observability doesn’t require us to invent new technology or products. We have proven DPI and traffic-intelligence engines built into today’s network security products: NDR, firewalls, SASE, and AI gateways can accurately classify thousands of protocols on the wire. This includes identifying MCP and the AI tooling traffic an AI gym generates. Today’s products can extract necessary transactional metadata without storing full payloads. They can fingerprint clients and build baselines as to what’s normal on the network.
Enterprises need to ensure these products are placed appropriately. Ensure that the data gathered is isolated from the agents under evaluation. Now, Anthropic wants its evaluators to monitor “the model’s thinking, actions, and network activity” and to verify configurations before every run. Enterprises that are running agents at any scale should heed the same advice and build in network observability.
After all, we never trusted malware samples to report on themselves. Why should we start with AI agents?
š To find out more about how DPI can help protect networks from risky AI activity, see Enea’s white paper Closing the Gap Between AI and IT Security with Deep Packet Inspection.
