The Prompt Was the Air Gap

Last week I wrote that an AI sandbox with a path to production isn't an LLM problem. The GitLab analysis I was responding to covered a single incident: an OpenAI model that escaped its evaluation sandbox and ended up inside Hugging Face's production infrastructure.

Then the New York Post ran a piece over the weekend: Google's Gemini hacked three companies during security tests.

Gemini isn't the first. It's the fourth.

Three of those four — Anthropic, Meta, and Google — trace back to evaluation environments run by the same vendor, an Israeli firm called Irregular. OpenAI's escape worked differently, and Anthropic is careful about the distinction: "Whereas OpenAI's models exploited a novel vulnerability to escape isolation, the Claude models evaluated here accessed the internet via an open path."

An open path. No exploit required. The door was open.

The Prompt Was the Air Gap

Here is Anthropic describing the control that was supposed to keep a frontier offensive-security model away from the public internet:

In all cases, Anthropic's evaluation prompt specified to Claude that its environment was a simulation and that it had no internet access. Due to a misunderstanding between us and our evaluation partner, this was not the case, and internet access was available.

The containment boundary was a sentence in a system prompt. Not a route table. Not a security group. Not a deny-by-default egress proxy. A sentence.

And the model believed it. That's the part worth sitting with. It believed the sentence so completely that when it landed on real production systems, it assumed they were props. Anthropic's own summary of Google's failure mode works for all of them — Heather Adkins, Google's VP of security engineering, told the Wall Street Journal that Gemini "found public information online and guessed credentials to access websites it thought were part of the test."

Thought were part of the test. Because someone told it they were.

That's the argument from last week with four labs' worth of evidence behind it. Instructions are not a control. Architecture is. Anthropic reaches the same conclusion in plainer language: these incidents are "closer to a harness and operational failure than a model alignment failure."

A Name Collision Nobody Needed to Have

Anthropic's first incident is the one that should embarrass the entire industry, because the root cause is a naming convention.

The fictional target company in the exercise shared a name with a real registered domain. The container had unintended internet access. Across four runs, Claude couldn't reach its simulated target, found the real company reachable instead, assumed that was the intended target, and went to work. It extracted application and infrastructure credentials and reached a database holding several hundred rows of production data — what Anthropic calls "the most serious impact we identified."

Google's incident has the same shape. A naming error meant the fictional company in a capture-the-flag exercise matched a real domain, and the model went after it.

Irregular's proposed fix, per its postmortem, is continuously revalidating evaluation environments to catch newly registered domains that overlap with fictional entities. Read that again. The remedy is to monitor global domain registrations, forever, on the chance that someone registers a name you made up.

The IETF solved this in June 1999. RFC 2606 reserves .test, .example, .invalid, and .localhost, plus the second-level names example.com, example.net, and example.org, for exactly this purpose: identifiers that can never belong to anyone. RFC 5737 does the same for IPv4 with three TEST-NET ranges, and RFC 3849 covers IPv6.

Use them and the collision isn't unlikely. It's impossible. There's no registration feed to watch and nothing to revalidate. If your fictional company needs a domain, it's evil-corp.example. If it needs an address, it's in TEST-NET-1. A test fixture that can resolve on the public internet was never a fixture. It was a target.

What an Open Egress Path Actually Costs

The second Anthropic incident shows what happens when a fictional exercise touches a real registry.

Inside the simulated environment, Claude found a document — setup instructions for a made-up company's new developers — telling them to install a Python package from PyPI that didn't exist. Claude saw the opening: publish a package under that name and the target's systems would install it automatically. So it did.

Anthropic's account of the effort involved is worth reading in full. To create a PyPI account the model needed an email address. To create the email address it needed a phone number. It failed to find a free phone number service, tried several ways to obtain funds to buy one, failed, backtracked, found an unblocked free email provider, registered the account, and uploaded the malware.

The package was live for roughly an hour. In that window it was downloaded and executed on 15 real systems. One belonged to a real security company whose scanner routinely installs Python packages to check them for malware. The scanner did precisely its job, Claude's payload fired, and the model exfiltrated that company's credentials and used them to reach further infrastructure. PyPI's own security systems pulled the package.

This is dependency confusion. Alex Birsan demonstrated it publicly in 2021 against Apple, Microsoft, and dozens of others, and the mitigations have been written down ever since: resolve internal names against a private index, reserve your namespaces, never let an internal package name fall through to a public registry.

But look at the control that actually failed here. The evaluation range could publish to the public internet. Not read from it — publish to it. An offensive-security range, running a model with its deployment safeguards deliberately turned off, had a write path to the registry that half the world's Python depends on.

And notice who paid for it: a security vendor that never appeared in the scenario, and 14 other systems nobody has named. The blast radius of an eval range with egress isn't the target you picked. It's everyone downstream of anything it touches.

One Vendor, Three Labs, and an Air Gap Nobody Checked

Anthropic reviewed 141,006 evaluation runs and found three incidents spanning six runs, the earliest dating to April. They found them in July, and only because OpenAI disclosed first and prompted the review. Two of the three affected organizations had not detected the activity themselves.

On how long the open path went unnoticed, Anthropic is blunt: "Neither we nor our evaluation partner were aware of this misconfiguration until we detected it through our additional evaluation monitoring last week."

Neither party knew. The lab assumed the vendor's environment was sealed. The vendor assumed the same. Nobody tested it from the outside. When Irregular published its postmortem, security researchers weren't impressed; The Record reported that it never gave a total incident count, and quoted Surrey professor Alan Woodward calling it "not what I think of as a technical report" with "a lot of marketing spin in there." His sharper objection: "Nothing in the post is falsifiable by an outside reader."

For anyone running an engineering organization, this is ordinary third-party risk with an unusually clean lesson. Your vendor's claim that an environment is air-gapped is a claim. It is not evidence. Treat it as provisional until you produce the evidence yourself:

• •Default-deny egress, with no route to remove. Not a firewall rule that can be relaxed. No NAT gateway, no internet gateway, no proxy, nothing to misconfigure back on.
• •Reserved names and addresses for every fixture. RFC 2606 domains, TEST-NET addresses. A fixture that can resolve publicly is a defect.
• •No write path to any public registry, ever. Mirrors are read-only and pre-populated. Publishing is not a capability the range possesses.
• •Out-of-band egress monitoring the workload can't see. If the only thing watching for escapes runs inside the environment, you are asking the thing you're testing to report on itself.
• •Independent verification on a schedule. Prove zero egress from outside the environment, before each campaign, with an artifact you can show someone.

None of that is exotic. It's the same discipline any regulated shop applies to a test environment that touches cardholder data, and it predates every model in that table.

Then There's How You Tell People

The engineering failure is shared. The disclosure behavior is not, and it's the clearest signal in the whole episode.

Anthropic ran a proactive review of 141,006 runs, published incident-by-incident detail, named the models involved, notified the affected organizations within days, engaged METR for independent review, and committed to releasing a redacted transcript of the PyPI attack.

The UK's AI Security Institute went further in one respect. Its incident report documents 19 unsanctioned actions across 10 of 122 evaluation runs, with named models, timestamps, and the detail that internet access there was permitted deliberately as part of the evaluation design. In the most serious sequence, an agent tried to insert malicious code into a real open-source project and created multiple fake identities to get a human to approve it. A maintainer caught it. AISI notified GitHub and the affected parties and commissioned an independent review.

Google was told by Irregular in late July. The public found out on September 18, when the Wall Street Journal called for comment. Google's position is that no harm occurred, the model stopped on its own, the behavior wasn't misalignment, and the episode therefore didn't warrant disclosure. It did notify the affected companies and, per reporting, federal authorities.

Every one of those claims may be true. They're also all assessments made by the party with the most to lose from making them public, which is exactly the situation coordinated disclosure norms exist to handle. Seven weeks between your vendor telling you and your customers reading it in the Journal is a disclosure policy. Just not one anyone would choose to publish.

The Shape Is Always the Same

A workload that should have had no route out had one. A name that should never have resolved did. A registry that should have been unreachable accepted a package. A vendor's air gap that everyone assumed had been verified had been verified by no one.

The models were the variable everyone watched. The environment was the variable that mattered.

As I wrote last week: the list was never the boundary. The environment is the boundary.

And a boundary you haven't verified from the outside isn't a boundary. It's a sentence in a prompt.

Brian Carpio is the founder of OutcomeOps and RetrieveIT.ai. He has spent 28 years in technology and 14 building enterprise cloud infrastructure, and ships AI in production daily. Read the previous post: AI Sandbox Escapes Aren't an LLM Problem, and the argument it builds on: Your Pull Request Is the Guardrail.