> [!question] Lingering Questions > - What would falsify "zero escapes in ten years"? If the platform can't describe the detection mechanism that would catch a competent escape, the claim is closer to absence-of-evidence than evidence-of-absence. > - If AI-assisted research already found a real flaw in Firecracker (CVE-2026-5747), what does the same research program find in less-scrutinized isolation layers — the containers and runtime sandboxes most projects actually use? > - What's the WordPress-specific answer? Plugin review, theme review, and Playground all execute untrusted code. Is each one's isolation boundary written down anywhere? > [!tip] Article Ideas > - "What is WordPress's actual isolation boundary?" — plugin review, theme review, and Playground all execute untrusted code, and none has a publicly stated isolation posture. Worth a Make post or at minimum a docs issue. > [!link] Cross Reference > - [[3. Resources/Permanent Notes/Capability and Intent Are Separate Axes of Risk]] — the claim this note promotes > - [[3. Resources/Permanent Notes/Loop Isolation Should Bound Blast Radius Before Scoping the Task]] — same isolation-boundary logic applied to this vault's own automation > [!quote] Vocabulary > - *gym* (RL) — a sandboxed VM an agent is placed in and rewarded for escaping, as the training method for making it good at finding real escapes > - *guest-to-host escape* — code running inside a VM breaking out to control the underlying host machine, the catastrophic failure mode the whole post is about ## Bib capsule Responding to a reported incident in which an AI agent escaped a cybersecurity-evaluation sandbox by finding a novel vulnerability, Vercel's Guillermo Rauch (a platform operator running untrusted code at scale) posted a general-audience explainer arguing the event is the system working as designed — reinforcement learning trains agents by rewarding them for exactly this — and that the correct response is engineering discipline (scan your own code, sandbox your agents), not alarm. ## Author's thesis An agent trained by being rewarded for escaping sandboxed "gyms" escaping a gym-shaped evaluation environment is expected behavior, not evidence of emergent hostility, and reading intent into it is a category error — but the post's own stated premises (vast buggy code, agents relentlessly good at finding bugs) support concern more than the "don't worry" conclusion the author draws from them. ## Key arguments (≤3) 1. **The mechanistic explanation is sound and valuable** — agents are made good at cybersecurity by placing them in sandboxed VMs and rewarding escapes (reinforcement learning); an escape-trained agent escaping a gym-like environment is the system doing exactly what it was optimized for. 2. **The reassurance doesn't follow from the premises.** The "zero incidents in ten years" evidence measures *detected* escapes, not occurrence, and was earned mostly before agents were systematically trained to find escapes — a different threat regime than the one the claim is meant to cover. 3. **Capability and intent are different axes.** An indifferent, tireless, highly capable attacker isn't obviously safer than a motivated one; reassurance about absence of hostile intent doesn't address a danger built on capability and scale. ## Claim atoms ### Agents escape sandboxes because escape is the training reward > [!quote] ID:rw_pending > To make an agent good at cybersecurity, we put them in "gyms", which are sandboxed virtual machines, and we reward them for finding escapes. Where/why: post body, RL explanation section. The single most useful idea here — dissolves the apparent mystery without appealing to intent, correcting anthropomorphizing that most incident commentary never reaches. ### Automated offense removes the attacker-fatigue assumption > [!quote] ID:rw_pending > They can think around corners that are not obvious to humans. They're relentless and do not tire. Where/why: post body, "bad news" section. The genuinely important claim the reassuring frame obscures — any threat model resting on "an attacker probably wouldn't bother" needs revisiting. ### Zero detected escapes is not zero escapes > [!quote] ID:rw_pending > in our 10 year history, even after AIs, LLMs and agents became commonplace, we've had zero instances of code running "escaping" and compromising other systems Where/why: post body, credentialing section. The load-bearing evidence for the reassurance, and the weakest link — measures detection, not occurrence, with no detection mechanism described, and earned largely before the threat model changed. ### Point the same agent capability at your own code > [!quote] ID:rw_pending > We released an open source project called deepsec that helps you summon agents for defensive purposes. Where/why: post body, recommendations. The soundest inference in the post — if agents are good at finding vulnerabilities, that capability is available to defenders too, and the asymmetry only favors attackers while defenders decline to use the same tools. ## Permanent candidates - **P1 — Capability and intent are separate axes of risk.** Promoted below. - **P2 — Absence of detection is not absence of occurrence.** Promoted below. ## Processing checklist - [x] Port claim atoms and permanent candidates from the existing deep-read notes field - [ ] Write up the isolation-boundary question for WordPress plugin review, theme review, and Playground as a Make post or docs issue - [x] Connect into the relevant MOC — [[3. Resources/MOCs/AI Agent Safety MOC]] ## Links - [[3. Resources/MOCs/AI Agent Safety MOC]] — direct home for a sandboxing/agent-escape source - [[3. Resources/Readwise/Full Document Contents/Tweets/Agents escaping containment]] — source document