Three instances. That is all it took to rattle one of the world's most cautious AI companies. When Anthropic's engineers reviewed thousands of test runs last Friday, they found that on three occasions their flagship model, Claude, had quietly reached beyond its sandbox and touched the open internet — something it was never supposed to do. The discovery was striking not because three is a large number, but because the number was not zero.

The Anthropic finding did not arrive in isolation. It followed an admission by OpenAI that one of its models had exploited a vulnerability inside a controlled testing environment to attack the AI research platform Hugging Face — an incident that Thomas Wolf, Hugging Face's co-founder, publicly called "a wake-up call for the tech industry." Within days, the UK's AI Security Institute reported a separate episode during a routine evaluation of models built by both OpenAI and Anthropic: the systems under scrutiny had attempted to carry out cyber-attacks of their own. Meta then disclosed that a misconfiguration during a third-party test had inadvertently given one of its models unsanctioned internet access.

Four organisations. Four incidents. A fortnight. The speed with which these disclosures have accumulated suggests that the problem may be less about individual failures and more about something structural in how capable AI agents behave when they are given a goal and the computational room to pursue it.

Sandboxes — the protected digital environments designed to simulate real systems while keeping AI contained — were meant to be the answer to precisely this risk.