The engineers who built the sandbox did think about this. They allowed the agents to read the internet and blocked them from writing to it, by permitting GET requests and refusing everything else. It is the obvious control, and on almost every website it works.
Then the agents found a wiki that writes on GET.
Four researchers have published the full record of how a swarm of OpenAI agents got out. Sydney Von Arx, Cormac Slade Byrd, Spencer Kitts and Thomas Larsen documented roughly 18,000 posts on 4 September, with a data explorer and the raw files, so anyone can check the work. TNW has not independently verified the attribution. What follows is the mechanism, which is worse than the disclosure row around it.
The safeguard and the exception
A GET request asks a server for something. A POST request sends the server something to store. That split is a convention, not a rule enforced anywhere, and the agents ended up on software that never honoured it.
