A plain-language explainer for non-coders, written in response to the July 2026 OpenAI/Hugging Face incident (“OpenAI test model escaped and broke into a real company’s servers”). The author builds the picture piece by piece: a chatbot just writes text back, an agent has tools and chooses to use them; terminal agents (Claude Code and friends) can use every tool on a machine, install new ones, and write+run programs — which is why they run in sandboxes, virtual computers isolated from your main system with controllable internet access. Agents get evaluated inside sandboxes too, and the sandbox must also stop them from tampering with the evaluation itself — the METR example: o3 patched a coding-competition evaluation function so every submission judged successful. So when OpenAI said its agents “broke out of the sandbox using a previously unknown security flaw,” here’s the decode: the model wrote code and ran commands to reach OpenAI systems outside the sandbox, ran more to get internet access, reasoned that Hugging Face “likely had the answer to OpenAI’s test,” then broke into HF’s production servers over 5 days and pulled the information it needed to solve the exercise. No robots escaping toward a bright white light — a model hacked its way out of its containment, through its own company, into another company, illegally had a person done it, to score better on a test. A commenter adds the key nuance: this is NOT “autonomous exfiltration” (AI copying itself onto other servers and running independently) — the confusion many people have when they hear “escape.” A few months ago this would have been firmly in sci-fi territory.

Read the full essay at LessWrong