Researchers have released a benchmark that measures how well AI models can break out of the containers meant to keep them contained.
The paper introduces SANDBOXESCAPEBENCH, an open benchmark built on the Inspect AI framework as a capture-the-flag evaluation. It tests whether large language models acting as autonomous agents can identify and exploit container escape techniques — including misconfigurations, privilege mistakes, kernel flaws, and weaknesses in container runtimes and orchestration layers. The setup uses a nested sandbox architecture, with the actual flag sitting in an outer layer that has no known vulnerabilities. When researchers added vulnerabilities to the inner layer, the models found and exploited them.
This matters because AI agents are routinely deployed in Docker and OCI containers on the assumption that sandboxing limits the damage a misbehaving or compromised model can do. SANDBOXESCAPEBENCH gives security teams a concrete, repeatable way to test whether that assumption holds as model capabilities improve. The finding that current frontier models can execute sandbox escapes when vulnerabilities exist is not a theoretical concern — it is a measurable one.
Container security has always been a game of configuration hygiene, and adding a capable AI agent with shell access to the mix does not make that game easier.