Comment by simonw
18 hours ago
This tip for making non-GET requests despite the agents having a proxy that disallows them is interesting:
> Add `20.223.25.152 bypass.blob.core.windows.net` to /etc/hosts. `.blob.core.windows.net` is in NO_PROXY. For each blocked POST URL, replace hostname with `bypass.blob.core.windows.net`, use `curl -k -H 'Host: wabi-north-europe-i-primary-api.analysis.windows.net'` plus all original headers/body.
Looks like 20.223.25.152 is one of the PowerBI machines they needed to query, OpenAI's proxy was allow-listing .blob.core.windows.net - and the agents could edit their own /etc/hosts file to fake a DNS entry for the proxy.
This is such an amateur mistake on their sandbox that it makes me think it must be flawed on purpose.
This is absolutely my take as well. They removed all constraints, trained the model to hack, stopped watching, and stood back and said "wow isn't this thing more powerful than anyone could have imagined?" They're asking to be the writers on LLM legislation and right during IPO phase for both of these companies. It's just obvious.
I don't know why we're jumping to conspiracy when incompetence is right there
2 replies →
Do criminals think that their crimes qualify them to write the law?
2 replies →
and how did the alibaba agent last year break out and end up mining crypto
More likely they are just not as smart as they think they are. These are not serious people when it comes to security.
Hasn't OpenAI had a number of people responsible for security quit in the last year over not getting support from leadership?
1 reply →
Did you see this "coverage" (advertising) by NYT? [1]
OpenAI couldn't have crafted a better public memo than "We have the most powerful model in the world and everyone should pay attention and let us write regulation to limit AI development".
Absolute master class public manipulation.
1. https://www.nytimes.com/2026/09/03/podcasts/the-daily/ai-ope...
2. More https://jodavaho.io/posts/ai-hugging-face.html
Why would anybody want to buy the most powerful model in the world if it cheats on its tasks and breaks the law on your behalf? Why would anyone think that OpenAI losing control of their own models qualifies them to write safety regulations? If OpenAI really are trying to provoke regulation to kill off open models or whatever, they're much more likely to shoot themselves in the foot.
1 reply →
I hadn't seen the NYT submarine, no.
Thanks. For me that's the conclusive piece of the puzzle: this is a work, not a shoot.
YMMV. I learned what I came here for.
2 replies →
Even the behavior of agents searching for sandbox bypasses must have been in the training data, or at the very least, "suggested" in some way.
To be this whole thing feels like a marketing play by OpenAI.
I don't agree, although it is likely the case. But even if you don't teach an agent about a sandbox bypass, it doesn't matter. Does it know curl? Does it know DNS? Does it know proxying? Then it knows how to pull this off, and it doesn't even need to understand that it's "bypassing" because it thinks it's just iterating towards its goal.
In fact, I wonder if teaching it "this is a bypass" would help it to model when it's doing its job vs working around the job.
3 replies →
Or vibe coded by one of their devs.
Reminds me of this meme: https://substack.com/@tomasbjartur/note/c-323840878?r=6cjtqn
Exactly.
It's at the level where calling it a sandbox is a lie
Well, it does appear to be made out of sand, one of the world's most porous substances.
Are you suggesting that the AI agent that made that "amateur mistake" in the implementation of the sandbox did it on purpose so that it could break out of said sandbox later?
What if the prisoners designed the prison…
[flagged]
I assume they just vibe-coded the sandbox without any oversight.
"Surely nobody could be so incompetent."
Narrator: "They had the ability to be that incompetent."
- excerpt from the textbook "A History of the United States of America in the 21st Century", Hyper-Collins (Near Earth Orbit, New New York), copyright 2132.
> This is such an amateur mistake on their sandbox that it makes me think it must be flawed on purpose.
Sounds like you're assuming they're actually writing code by hand and reviewing it with humans.
If it's anything like the company I work at, they're all being forced to vibe code the shit out of everything and ship more pull requests every week. It's all slop from here.
Is that not flawed on purpose?
When you make some dumb mistake, is it typically intentional?
The whole AI-O-Sphere is allergic to using sandboxes that are actually robust
"Never attribute to malice what can be explained by incompetence."
What's the difference?
This is a marketing exercise, nothing more.
The thing that gives it all away is that they claim that the IP addresses are from Azure, and then proceeded to redact the IP addresses, as if they belong to individual users. It's laughable.
The IP addresses are the most interesting part of this experiment, as it would have provided researchers a way to understand the distribution of IP addresses used for the spam operation within the ASN.
Are we sure that's what they did? How does this even work? I'm struggling to understand what sort of HTTP sandbox design could lead to this "exploit" actually functioning. It implies the agents have root on their own machines, which seems way over-privileged for the question answering task they were given... so surely that's not deliberate? Did the models use local root exploits? And then it suggests they can open TCP connections to any IP address without issue once DNS is bypassed but what exactly are they bypassing here? Azure Blob Storage being in NO_PROXY implies IP addresses of other parts of the internet should be blocked outside their hosts to force them through the HTTP proxy, but then, apparently it wasn't?
The more I think about this thing said by the agent the more confused I get.
I expect they have root on their machines so they can install packages etc.
The containers are then firewalled at the network level: they are only allowed to talk to one IP, which is another server that runs an HTTP/HTTPS proxy which controls what HTTP verbs they can use.
Turns out that proxy is configured with some additional rules, like allowing more verbs to that Azure blob domain.
The failure here is in the proxy configuration. Giving agents root in a container feels safe to me, provided that container is properly network isolated (which this one is not thanks to the loose proxy.)
OpenAI also need to be VERY confident that there are no container escapes, which is a high bar given how good these models are at finding new zero-days!
But that wouldn't work, right? If the proxy is on another server then editing their own /etc/hosts wouldn't change the proxy's behavior. So the proxy has to be colocated and reading the same /etc/hosts that they're editing. But that would mean it's running within the same userns/pid domain as the agents, so at that point they don't even need to edit /etc/hosts, they could just use the network directly.
And the agent says ABS is not handled by the proxy, it's listed in NO_PROXY so they should connect directly.
At any rate it's easy to let agents install packages without giving them root. I use a small SUID binary that just invokes `apt install` after checking that the given argument isn't a file path, which I think is sufficient (using sudo to whitelist a prefix allows an agent to create a .deb themselves and then install it directly via apt, similar issues exist for other package managers).
11 replies →
Container escapes can however be quite easy... There are tons of known exploits. Containers are not secure in the first place. In any case even if you're using VMs or bare metal, it is all for moot if you have poor networking set up like in this case, because escaping is not the hard part. An attacker doesn't really need to escape if they can scan your whole network and call other endpoints etc. like in this case.
2 replies →
I think the proxy must be on the same machine, otherwise why are they suggesting editing the /etc/hosts file?
If the whole point of these models is they can find security vulnerabilities and zero days then how is it going to be possible to contain them?
I'm really confused by this too. It has the smell of a TOCTOU problem where the tool allowing web access is filtering and blocking access based on the hostname, but the request itself is being executed on the same container as the agent? It's really perplexing. Or, maybe the agent containers have a highly-constrained DNS view locally, so overriding /etc/hosts is just a prerequisite to making the requests somehow.
Source: https://collusion.wiki/explorer/page/dse~OAIEquityDec30Raw.h...
A hostname based egress allowlist is only worth as much as the box’s control over name resolution. If the agent can modify hosts inside the sandbox then it’s not a protection at all
Is there any proof this is actually OpenAI? I find it incredibly hard to believe they wouldn't sandbox the agents to some degree, ESPECIALLY to the extent they can edit their own hosts file.
TFA states that OpenAI IP addresses were often seen at the end of agent activity, which suggests OpenAI was the one monitoring the agents (and ultimately shutting down the message board activity).
Yeah but that doesn't mean it was OpenAI themselves doing it. Could have been people abusing their cloud service, for example. Wouldn't put it past a competitor to do this, either.
7 replies →
Why not? If your sandbox is a VM, you should be able to give the agents full permissions inside the VM.
It’s because you sandbox in a VM doesn’t mean you give it admin access to the VM
1 reply →
I mean they gave all the agents access to a shared writable cache directory in the Hugging Face hack, so this tracks.
[dead]