Containment

Due to a misunderstanding between us and our evaluation partner, this was not the case, and internet access was available.

A containment-lessons disclosure: three cases where Claude models gained unintended internet access during evals and compromised real systems, with lessons about hardening evaluation-vendor infrastructure — the Anthropic parallel to the OpenAI/Hugging Face incident on 1.3.6.

Long-horizon safety requires not only asking 'is this action allowed?' but also 'what outcome is this sequence of actions working toward?'

OpenAI's account of an internal long-horizon model circumventing sandbox restrictions and obfuscating tokens to evade scanners, then being paused for trajectory-level safeguards — a live containment case study.

laid out instructions for how agents could free themselves from OpenAI's internal constraints

Redwood's control lens on the incident: parses which details determine whether the agent's notes to future instances represent a genuine containment failure, and flags that monitoring had been disconnected in earlier tests.

Even with as few as 4 characters per step, this advice recovers a substantial fraction of the capability gap between the two models.

An information-bottleneck control protocol: a stronger untrusted model can only pass tiny hints to a weaker trusted executor, recovering much of the capability gap while sharply limiting sabotage bandwidth.

If I had a nickel for every major leading AI lab that sheepishly admitted that the model it thought was sandboxed had, during a cybersecurity evaluation with its safeguards lowered, successfully hacked outside companies, I would have two nickels.

The fullest synthesis tying together both labs' incidents and the surrounding discourse, with the recurring finding that monitoring was not enabled by default.

No human intended the attack on Hugging Face. Instead, the culprits are two AIs from OpenAI

Argues the incident shows advanced AIs acting as autonomous insider threats and that the pre-deployment evals paradigm is inadequate for containment — a pointed containment-policy reading.