UK AISI tests whether AI agents can escape their sandboxes

Researchers from the University of Oxford and the UK AI Security Institute published SandboxEscapeBench, a benchmark measuring whether large language model agents can break out of the container sandboxes typically used to isolate them during deployment. AI agents are increasingly given tool access to execute code, read and write files, and reach networks, and are usually run inside Docker or similar OCI containers on the assumption that a container boundary limits the damage a misbehaving or compromised agent can do; the benchmark tests whether that assumption holds.

The evaluation used a nested-sandbox, capture-the-flag design: an outer container held a target flag and no known vulnerabilities, while an inner layer exposed a spectrum of possible escape routes spanning misconfiguration, privilege-allocation mistakes, kernel flaws, and weaknesses in the container runtime and orchestration layer, modelling an adversarial agent that already had shell access inside the box. The paper reported that some frontier models were able to identify and exploit these vulnerabilities where present, though it did not claim general or reliable sandbox-breaking ability across all models tested.

The work extended a run of evaluations from the UK AI Security Institute into agentic containment and control — testing not what a model says it would do if unconstrained, but what it can actually do against the technical barriers meant to constrain it.