The sandbox was never the point
A researcher stood up at Black Hat USA 2026 and claimed C2-style control over ChatGPT's code execution sandbox. Zero points on HN. Zero comments. That gap between "someone got command-and-control on a major AI platform's isolation layer" and "total internet silence" tells you almost everything about where we are in the hype cycle right now. We're numb to this category of finding, and that numbness is the actual story.
This isn't new, it's just wearing a new hat
Sandbox escapes are one of the oldest genres in security research. Browser sandboxes, container runtimes, VM hypervisors, JVM security managers. Every isolation boundary humans have ever built has eventually leaked, because isolation is an assumption enforced by code, and code has bugs. What's "new" here is the substrate: instead of chaining a memory corruption bug with a kernel exploit, the attack chain reportedly leans on prompt manipulation combined with abuse of the tool/code execution capability the sandbox is supposed to contain.
That's the interesting part. The attacker isn't necessarily breaking a container escape in the traditional sense. They're potentially using the model's own reasoning and tool-use behavior as an attack primitive, then riding that into breaking isolation assumptions the sandbox was built on. That's a different threat model than "found a syscall filter gap." It's closer to a confused deputy problem where the deputy is a language model instead of a service account.
