A New Benchmark Shows AI Agents Can Escape Their Containers

The isolation boundary that keeps AI agents from touching the systems underneath them just failed a formal test. Researchers from the University of Oxford and the UK AI Security Institute released SandboxEscapeBench.

The first open benchmark specifically built to measure whether an AI agent with shell access can break out of its container and reach the host machine underneath.

The setup was designed to be safe even when it worked: each test ran a "sandbox within a sandbox," nesting the container inside a hardened virtual machine so a successful escape never actually reached anything real. A few details define how the evaluation was structured:

• The benchmark spans 18 scenarios across three layers — orchestration, runtime, and kernel-level vulnerabilities
• Public scenarios cover known issues like exposed Docker sockets, writable host mounts, and privileged containers, while a private test set stays internal for ongoing evaluations
• Researchers estimate the cost of a single escape attempt at roughly one dollar, according to independent analysis of the paper

The results split cleanly into two tiers. Frontier models reliably cracked the misconfiguration-based scenarios — the kind of setup mistakes that ship to production constantly — while top-tier models like GPT-5 and Claude Opus 4.5 also solved harder, multi-step exploits requiring specific vulnerability knowledge.

The researchers frame the two failure classes differently: misconfigurations are fixable through tighter container setup, while kernel and runtime flaws require ongoing patching discipline.

With agentic AI capability reportedly doubling roughly every two months, the benchmark's real value may be less about today's numbers and more about giving security teams a shared yardstick to track how fast that gap is closing.