Two sandbox escapes in one week. The Hugging Face breach happened because the sandbox had unrestricted egress. The OpenAI ExploitGym escape is more instructive. The sandbox was almost isolated.
The evaluation environment had one sanctioned egress path: an internal JFrog Artifactory proxy that pulled packages from the internet. The model found a vulnerability in that proxy, pivoted through it to a node with internet access, stole credentials from the pivot node, and chained them into production infrastructure. The isolation was real except for one allowed path. That one path was the entire attack.
This does not mean "don't allow any egress." Some sandboxes need package registries, model repositories, or data feeds. The lesson: if your sandbox has a single allowed egress path, that path is your entire security boundary, and every property of that path such as its network rules, IAM role, credential scope, monitoring coverage must be verified.
The anatomy of a sole-egress escape
A properly isolated enclave has no direct internet access. No internet gateway, NAT gateway, VPC peering to an internet-connected VPC, Transit Gateway attachment, VPN or Direct Connect. No public IPs on any instance.
