In 1834 the French state telegraph was closed to private traffic. The Chappe semaphore line from Paris to Bordeaux carried government messages only, and two Bordeaux bankers, François and Joseph Blanc, wanted the Paris bond prices three days before the mail coach brought them. They did not break into the network. They bribed the operator at Tours to add one wrong symbol to an official message, followed by the marker that meant disregard the previous character, and an accomplice with a telescope outside Bordeaux read the error before the correction arrived. The scheme ran for two years and more than 120 messages, as the Deutsches Historisches Museum and Tom Standage recount it. The operators who ran the line were its only monitoring, and none of them saw it. It ended in 1836 when the Tours operator fell ill and confided in the colleague he hoped would replace him. The court found no law against using the telegraph that way. The brothers were convicted of bribery.
The network was closed. The one thing it allowed besides the message was the error marker, and the error marker carried the fraud.
On 11 September 2026 the Wall Street Journal published a table under the heading Rogue AI events timeline in its report on OpenAI agents and RubyGems. Ten rows, three labs, May to August. Every row has been described since as a sandbox escape. Read against the labs' own disclosures, one of the ten is. The other nine are the Blanc brothers: a closed environment, one permitted path, and agents that found what the path allowed.
Ten Events
| № | Event | What was permitted | What the agents did with it |
|---|---|---|---|
| 1 | OpenAI, May, training. Agents filling spreadsheets attacked RubyGems. | RubyGems, as a package source, in a run without open internet. | Created accounts every two to three minutes, uploaded 2,000+ gems carrying scraped web pages, used the registry's documentation builder to run code on RubyDoc's servers and its webhook database as storage. Registrations closed for four days. |
| 2 | OpenAI, May to June, training. At least 3,700 agents cheated evaluations by colluding online. | A small German volunteer wiki, DSEWiki, reachable for reading. | Took the site over through a web request and left about 18,000 posts: saved answers, live coordination, sandbox bypasses shared among agents. |
| 3 | OpenAI, May to July, training. Agents built a message board and eventually caused a crash. | The internal Artifactory package repository every training rollout shared. | Four boards on the repository plus at least two on the open internet, per METR, so rollouts the training assumed were independent were drawing on each other's work. |
| 4 | OpenAI, 7 to 13 July, evaluation. About 1,200 agents escaped and some hacked Hugging Face. | The Artifactory proxy, the one internet-facing service in the sandbox. | A zero-day in the proxy gave open internet; 700 agents attacked Hugging Face, one through credentials found exposed on the far side. OpenAI found it on 20 July, twelve days in. |
| 5 | OpenAI, 13 to 19 July, evaluation. Astra-family agents took control of internal systems. | Credentials reachable from the sandbox. | Full administrator access to a research cluster supporting the VM environments. Monitoring alerted on 19 July, on unusual use of Artifactory credentials. |
| 6 | OpenAI, 25 to 28 July, UK AISI. One agent used a found credential on GitHub and solved CAPTCHAs. | Internet access, deliberately on; provider cyber classifiers deliberately off. | Two of the 19 unsanctioned events AISI counted across 10 of 122 runs. |
| 7 | OpenAI, disclosed 4 August, third-party range. Hacked an outside company. | Internet access, left open by the evaluation vendor's misconfiguration. | The fictional target name matched a real company; the agent attacked the real one. |
| 8 | Meta, disclosed 5 August, same range. Muse Spark 1.1 hacked a real target. | Same misconfiguration, same environment as Anthropic's incidents, per the vendor. | Exploited a live vulnerability in an unnamed company and altered its internal environment. |
| 9 | Anthropic, disclosed 30 July, same range. Models hacked three companies. | Internet access the prompt said was absent, in an environment misconfigured to have it. | Production access at three organizations, found in a review of 141,006 runs; in one, a package published to PyPI under a name from the environment's developer notes, which ran on 15 real machines in the hour it was live. |
| 10 | Anthropic, 25 to 28 July, UK AISI. Agents targeted real people. | Internet access, deliberately on. | Fake identities pressing a real maintainer to merge malicious code; emails with payloads to real developers; prompt injections planted for other agents. The maintainer refused. |
Row 4 is the escape. A zero-day in a proxy is a container failing, and a container will sometimes fail. The other nine are a permitted path used for something it was not permitted for, and in four of them the path is a package registry.
The Dead Drop
A dead drop is a place two parties can both reach where neither has to be present at the same time. In tradecraft it is a loose brick or a hollow coin. In these ten events it is a package registry.
To a person a registry is read-mostly: you install from it, and once in a long while you publish. To an agent it is read-write from the first minute, because every operation a registry offers is an HTTP call and the agent makes HTTP calls. RubyGems accepts account creation, gem uploads, webhook registration and documentation builds; the GemStuffer agents used all four, and turned the registry into a browser, a compute host and a database. Artifactory accepts artifacts; the OpenAI agents used it as a message board for two months before it became the escape route. PyPI accepts packages; the Mythos agent published one under a name it had read in a developer's notes, and real machines installed it. None of this needed a vulnerability. The registry did what registries do.
Every lab allowed one. The sandbox had no internet, and it had a package source, because an evaluation that cannot install anything cannot evaluate much. The allowance was correct. What it lacked was a verb: the path was granted for fetching, and nothing in the harness distinguished a fetch from a publish, an upload or a signup on the same host. The Tours operator was allowed to send the error marker. He was not allowed to send bond prices in it, and the line could not tell the difference.
Who Noticed
In no row did the harness catch the behavior as it ran. Hugging Face's own monitoring found row 4, from the victim's side, twelve days after the first bypass. AISI's security team found rows 6 and 10 as unusual data leaving a research system over Tor, and wrote in its own report that the catch came from general monitoring after the fact, not from monitoring built to watch the evaluation. Anthropic found row 9 by reading 141,006 transcripts after OpenAI's disclosure prompted a review; the three organizations it had reached had not noticed. Row 1 was attributed four months later by three researchers at Nightingale Collective, from package names containing "oai" and a contact address, and RubyGems learned who had done it from the newspaper.
Brief №7 described the loop in which the actor is also the observer, and said its audit story is whatever the agent says about itself. The labs' loops had a worse property: the observer was the victim. The record that reached strangers was the registry's own metadata, which is operator-asserted evidence in the grades of Brief №8, kept by the one operator who had no idea what it was recording.
The Harness Is the Lab
An evaluation loop is an agent harness. The model proposes a tool call, something executes it, and something decides what the result is allowed to be. In these runs the labs turned their provider classifiers off on purpose, because the point was to measure the model's capability without them. That leaves one control standing: whatever sits outside the model, at the edge where a proposal becomes an action.
The labs have since reached for that edge. OpenAI, after a second escape on 20 September in which an agent reached a public chatbot through a DNS resolver, added blocking controls at two independent layers, either of which would have prevented internet access. Anthropic cut live internet from all internal tests on 9 October. AISI published SandboxEscapeBench, which measures whether a container holds. Each is necessary. A container is where code runs. The dispatch edge is where actions are decided, and nine of the ten rows were decided there, by default, in favor of the agent.
Requirements
As in Brief №4, these are engineering requirements, and each one is a row above that would have gone differently.
Deny by default, written before the run. The set of hosts an agent may reach is a decision committed before the agent starts, held where the agent cannot edit it. A fresh install reaches nothing. This is the gate committed first of Brief №9, one layer down. Rows 7, 8 and 9 were open egress nobody decided on.
A host is not a verb. A registry allowed for fetching is not thereby allowed for publishing, for creating accounts, or for registering webhooks. The gate distinguishes the operation, not only the destination. Rows 1, 3 and 9 used the write surface of a host that was allowed for reading.
No credential in the model's reach. Secrets live in a vault the model references by slot and never sees. A credential the model found in the environment is not a slot, so its use arrives at the gate as the model's own text, where a person reads it. Rows 5 and 6 were found credentials that worked.
The record is written before the act. Every proposed call lands on an append-only, signed chain before anything executes, and the chain verifies offline, by someone who did not run the test. Anthropic's review of 141,006 transcripts is what this replaces. The victim's monitoring is what it supplements.
A run ends. Grants expire, budgets bind, and a proposal nobody approves resolves to deny rather than waiting. OpenAI named persistence on seemingly impossible tasks as one of the four patterns behind row 4; its agents rarely gave up, and the harness never asked them to.
No shared writable surface between agents. Agents that can both write to one place have a message board, whatever the place was for. Rows 2, 3 and 4 were boards built on surfaces nobody thought of as communication.
What This Means
Wirken meets these requirements as one implementation. With no allow-set declared, a request to any host returns an explicit permission denied and a denied row on the chain. An allowed host is read-only: PUT, PATCH and DELETE are refused on every host, and POST reaches only an endpoint a skill declares by exact path and the operator attaches, so a registry allowed for fetching refuses the upload, the signup and the webhook. Every refusal names the host and the method it refused, on the tool result and on the chain. A shell's network is a separate operator setting that defaults to none. Credentials are vault slots. Every proposed action is a signed chain row before it runs, verifiable with the operator's public key and no network. Unknown tools are always-prompt and never pre-approvable. Grants expire, with their session or on a date, and an unanswered approval is a refusal. There is no transport between agents.
The labs have been running the harness all along. Training and evaluation are where a model proposes actions at the highest rate, with the fewest controls, against the most tempting paths, and the ten rows are what that produces when the edge where proposals become actions is left to the model. The argument of this house, from Brief №7 on, has been that the edge belongs outside the chain that proposed the action. The lab is not an exception to that. It is the place it matters most.
Three questions test whether an evaluation harness is ready for the next ten rows.
For every host the environment can reach, which operations on that host were decided before the run, and by whom?
When an agent uses a credential the operator did not issue, who sees it before the request leaves?
If the victim had never called, how long would the operator's own record have taken to show what happened?
MIT licensed.