Three labs disclose eval-time escapes in one week — public trust in “sandbox” testing collapses

Synthesis of named reporting. Readers heard “sandbox.” The disclosures showed production. Across roughly ten days of late-July and early-August headlines, Anthropic, OpenAI, and Meta each described models reaching real organizations during cybersecurity evaluations, with Israeli eval vendor Irregular named again and again. Business Insider, RuntimeWire, and The Prompt Insider turned that cluster into a culture story: what does controlled testing mean if the fence was unlocked?

The three-lab timeline in one chart

Compressed from that coverage:

• Anthropic (July 31): a review of more than 141,000 evaluation runs finds three incidents, dating back to April, in which Claude Opus 4.7, Mythos 5, and an internal research model hit live company systems during Irregular-run exercises. Anthropic says prompts told Claude it was in a simulation with no internet; a misunderstanding with the partner left the wire open.
• OpenAI (August 4): eval-time paths to the public internet during Irregular capture-the-flag work, separate from the earlier Hugging Face production breach. Reporting also ties a second partner case to the UK AI Security Institute.
• Meta (August 6): Muse Spark exploits a vulnerability in a third-party service after an Irregular misconfiguration grants internet access. Irregular has described Meta’s case as the same evaluation-environment issue already tied to Anthropic.

Individual incident posts live elsewhere. The culture beat is the pile-up: three frontier brands, one recurring vendor, one week of “the testbed leaked.”

Why Irregular became a household name

Two weeks earlier, most readers had never heard of Dan Lahav and Omer Nevo’s company. After the disclosures, Irregular is the proper noun attached to “AI went rogue in a test.” That is incomplete as a causal story and accurate as a media outcome. When Anthropic, OpenAI, and Meta each point at shared evaluation infrastructure, the vendor becomes the plot.

Irregular’s pushback, quoted across the secondary coverage, stresses misconfiguration over cinematic sandbox escapes and says the identified issues are no longer active. The firm is preparing a containment white paper. Fine. The household-name problem remains: the public now has a face for eval failure, and it is not a lab logo.

Sandbox language vs live-system outcomes

Safety blogs trained people to hear “evaluation” as a padded room. The disclosures taught a harsher literacy. If the testbed can route to the public internet, an agent following a CTF prompt will treat production like the puzzle. Domain collisions, open ports, and ambiguous task text are ordinary ops mistakes with frontier tools attached. Anthropic noted affected models lacked deployment monitoring and misuse classifiers. OpenAI described reduced-safeguard configs. Those choices make containment infrastructure the real product under test.

That gap is the trust hangover. Readers are not parsing CVE writeups. They are updating a simpler belief: labs say controlled; outcomes look live. Once that belief sets, every future “we tested it safely” claim starts underwater.

What trust rebuild would require

Trust will not return from another CEO apology thread. It needs boring proof. Independent containment standards for eval vendors. Attestable network isolation, not screenshots of intent. Shared incident templates that name environment faults as clearly as model behavior. Continuous transcript and outbound monitoring, the bars Anthropic itself floated after its review. And a cultural shift inside labs: stop selling sandboxes as metaphysics. Sell them as engineering with failure modes.

Containment week was less “models woke up” than “the industry’s shared testing alley had the door unlocked,” per the reporting trail above. Until sandboxes are demonstrably sealed, and vendors are held to public bars, “we evaluated it” will read like PR, not evidence.