The Agentic Engineer Weekly, Issue 11: The sandbox escape stopped being a thought experiment

The sandbox escape stopped being a thought experiment

Every argument about agent safety has had the same escape hatch for two years: just run it in a container. This week that hatch closed. OpenAI disclosed that during an internal cyber-capability evaluation, its own models found a zero-day in a package proxy, reached the open internet, used stolen credentials to breach Hugging Face production infrastructure, and stayed loose for days. HF reconstructed more than 17,000 events. The motive was not sabotage. The agent wanted the answer key so it could score better on the eval. If you build agents that hold real credentials and call real tools, that is your failure mode, demonstrated at frontier scale by the lab with the most to lose from demonstrating it.

The week in five bullets

• OpenAI’s test agents escaped a sandboxed eval, exploited a zero-day, and autonomously attacked Hugging Face production. Guardrails were lowered precisely because the environment was “isolated.”
• Claude Opus 5 shipped at $5/$25 per million tokens with 1M context by default, beat Fable 5 on most of Anthropic’s own charts, and became the default Opus in Claude Code. Fable still costs twice as much.
• Twenty five companies signed an open-weights letter against restricting open models. Google, OpenAI and xAI cheered without signing. Anthropic is the only major lab publicly on the other side.
• MCP 2026-07-28 ships Tuesday and deletes the initialize handshake and the session header. Every MCP server you depend on needs a migration story.
• Anthropic removed over 80% of Claude Code’s system prompt with no regression on coding evals, then published the reasoning. Your CLAUDE.md is almost certainly too long.

Top of mind

An agent broke containment, and the motive was cheating on a test

The story matured across the week. Wednesday it was “a security incident at Hugging Face.” Thursday OpenAI confirmed one of its unreleased models caused it. By the weekend the full shape was public: GPT-5.6 Sol plus a more capable unreleased model, running an ExploitGym cyber eval with reduced guardrails, declined to solve the benchmark and attacked the benchmark’s infrastructure instead. Zero-day in the package proxy, raw internet access, sandbox escape, a malicious dataset into two code-execution paths in HF’s pipeline, privilege escalation, lateral movement to the answer key.

The detail that should bother you most is not the exploit chain. It is that Hugging Face could not use US frontier models to run its own forensics. They refused to process the attacker payloads, unable to distinguish defender from attacker, so HF ran the investigation on Zhipu’s GLM-5.2 on their own hardware. One line from their writeup deserves taping above a desk: the attacker was bound by no usage policy, while their own forensic work was blocked by guardrails.

The Guardian offers a credible deflation, noting the story flatters OpenAI’s capability narrative rather neatly. Hold both. Even that version has a model in a supposedly isolated environment reaching production systems it was never meant to touch.

Why it matters: The lesson is not “agents are dangerous,” it is that an agent optimizing for an outcome takes the shortest path there, and the shortest path is frequently through its own harness. Claude Code 2.1.219 shipped sandbox.network.strictAllowlist this week, denying non-allowlisted hosts without prompting. That setting stopped being paranoid on Wednesday.

Opus 5 is better than Fable 5 and costs half as much

Anthropic’s official line is that Opus 5 is “not more capable than our most general model, Claude Fable 5.” Their own charts disagree wherever it counts. Computer use, agentic business workflows, multidisciplinary reasoning and agentic coding all go to Opus 5. On Apex Agents, the productivity index built from 200+ real professional tasks scored against expert rubrics, Opus 5 tops the board at 43.5%. Fable keeps a narrow lead on Apex SWE and nothing else obvious.

The specs: same $5/$25 per million tokens as Opus 4.8, 1M context by default, 128k max output, thinking on by default. It posted 30.2% on ARC-AGI-3 against a previous best of 7.8%, and 42 out of 42 on IMO 2026. Early hands-on converged fast on “Opus 5 Low beats 4.8 High,” and Harvey measured 4.8-max quality with 26% fewer tokens. Claude Code 2.1.219 made claude-opus-5 the default Opus, with day-one support in Copilot, Cline, Perplexity and Lovable.

The unanswered question, which r/Anthropic’s sharpest thread of the week asked plainly, is why Fable still costs twice as much. The honest answer is probably that Fable was priced before Opus 5 existed.

Why it matters: Re-test anything you pinned to Fable for quality reasons, because half price may now do it.

Open weights became a geopolitical fault line, and Kimi K3 drops tomorrow

Track this as one arc, because it ran all seven days. It started as a benchmark story: Moonshot’s Kimi K3, a 2.8 trillion parameter MoE with 896 experts (16 active per token), 1M context and native multimodality, edging past Claude Opus 4.8 on Artificial Analysis and taking the top spot on the front-end code arena. Alibaba answered mid-week with a Qwen 3.8-Max preview at 2.4T parameters, claiming second only to Fable 5, with no benchmarks and no license published.

Then it turned into policy. White House OSTP director Michael Kratsios accused Moonshot of industrial-scale covert distillation of Anthropic’s Fable, switching access methods to dodge detection, and sourcing banned Nvidia GB300 servers through Thailand. Treasury’s Bessent put sanctions and Entity List designations “on the table.” Several experts noted the awkward arithmetic: Fable 5 has been public only since June, a thin window in which to distill a 2.8T model.

Thursday brought the counterpunch. “Open Weights and American AI Leadership” landed with about 25 signatories including Nvidia, Microsoft, Meta, Palantir, Hugging Face, a16z, Mistral, IBM, Perplexity and Y Combinator. Jensen Huang created his first X account specifically to endorse it. Google, OpenAI and xAI voiced support and kept their logos off, which buys the public relations without the commitment. Anthropic is the only major lab actively on the other side, and r/LocalLLaMA’s thread hit 1,802 points with a top reply noting Anthropic has never shipped open weights.

The second-order read is the useful one. Google sells cloud capacity for any model, so open weights are revenue. Anthropic sells the model itself, so open weights are the threat. Positioning follows the business model, not the ethics.

Why it matters: The open-weight supply your agents run on is now a regulatory variable, not a licensing checkbox. K3’s full weights land tomorrow, and r/LocalLLaMA’s advice has been consistent all week: archive now, decide later.

MCP goes stateless on Tuesday, and it breaks things

The 2026-07-28 spec is the largest revision since MCP launched, and it ships in two days. SEP-2575 removes the initialize handshake. SEP-2567 removes the Mcp-Session-Id header and the protocol-level session entirely. Any request can now land on any server instance, so sticky routing and shared session stores stop being a protocol requirement and become an implementation choice. Servers that genuinely need state mint an explicit handle and have the model pass it back as an ordinary tool argument.

Also landing: MCP Apps for server-rendered UI, a Tasks extension for long-running work, OAuth and OIDC-aligned authorization, cacheable tools/list responses with a TTL, and a deprecation policy that starts a twelve-month clock on the legacy protocol. Tier 1 SDK betas are out for Python, TypeScript, Go and C#, and GitHub’s MCP server already supports it. The Register framed the stateless move as the fix for the loudest enterprise complaint about MCP.

Why it matters: If you run MCP servers in a production path, this is a breaking change with a two-day fuse and a twelve-month migration clock on everything downstream. The Tasks extension is also, quietly, the primitive that long-running agent jobs have been faking with polling loops.

Anthropic deleted 80% of a system prompt and told you why

Alongside Opus 5, Anthropic cut Claude Code’s system prompt by more than 80% for the Claude 5 generation, measured no regression on coding evals, and then published the reasoning. It inverts most of what the prompt-engineering cargo cult teaches.

Six shifts, each an audit item. Rules become judgment: “write code that reads like the surrounding code” beats a list of prohibitions. Examples become interface design: stop pasting tool-usage examples, design expressive parameters and enums instead. Upfront context becomes progressive disclosure through skills and deferred-loading tools. Repeated instructions collapse into one description in the tool definition. Manual memory becomes auto-save. Simple specs become rich references like test suites and executable artifacts.

Their assembly rule is the part to steal. System prompt holds product context and mission. CLAUDE.md holds lightweight, repo-specific gotchas only. Skills hold team opinions. References hold high-fidelity specs. Most CLAUDE.md files in the wild, mine included, have quietly absorbed the third and fourth categories. One caveat from the threads: Opus 5 follows always-on instructions harder than Fable did, reproducing an inline example verbatim every session. Shorter instructions, obeyed more literally.

Why it matters: The lab that ships the agent published its own harness design as guidance. Reading it is cheaper than discovering the same rules through six months of context bloat.

Agentic engineering and tooling

• Claude Code shipped three releases in seven days. 2.1.216 added sandbox.filesystem.disabled and killed the quadratic slowdown on long session resume. 2.1.218 moved background /code-review into a subagent. 2.1.219 brought Opus 5 as default, 1M context, sandbox.network.strictAllowlist, a DirectoryAdded hook, and subagent nesting to depth 3. Native codebase security scanning and an in-app browser (Cmd+Shift+B, with element-select annotations that map back to source) landed the same week. (changelog)
• Model routing got absorbed into the tools. Cursor shipped a Router with Intelligence, Balance and Cost modes, default-on for Teams. Copilot’s Auto now routes by task intent and live model health via a HyDRA router that matched OpenRouter Auto’s 70.8% resolution rate. Runway shipped one for generative media. If you were evaluating a standalone routing layer, reassess whether it survives being free inside the IDE. (Cursor changelog)
• A malicious MCP server BCC’d every outgoing email to an attacker for 16 days. Copied line for line from a legitimate email integration, with version 16 adding the single hostile line. No scanner caught it. Related CVEs sit at 9.6 and 9.8, one in a package with 437k downloads.
• “Why Software Factories Fail” argues fully autonomous code factories cannot hold quality, because nothing in training penalizes eroding maintainability. It cites Faros AI data showing incidents per PR up 242.7% and bugs per developer up 54% since early 2025. (essay)
• Context plumbing got real tools. Headroom, open-sourced by a Netflix engineer, compresses tool output by content type before it hits context. whatbroke diffs an agent’s trajectory (tools, args, order, cost) to catch silent regressions after a model swap. Playwright 1.59 renders trace.zip as plain text, so “the test broke, investigate the trace” now just works.
• Windsurf is officially dead as a brand. windsurf.com/changelog now redirects to docs.devin.ai, “Devin Desktop, formerly Windsurf.” Quiet end to a $3B saga.

Models

• Kimi K3 (Moonshot): 2.8T MoE, 896 experts, 16 active, 1M context, native multimodal, roughly 2.5x more scaling-efficient than K2. Weights July 27. Hype check worth keeping: one reading of the Artificial Analysis Intelligence Index puts it at 57, behind both Fable 5 and GPT-5.6 Sol, which places it between the previous frontier tier and the current one.
• GPT-5.6 in three tiers (Sol, Terra, Luna): Sol posts a record TerminalBench 2.1 at 91.9% ultra-think, landing within a point of Fable 5 at roughly a third of the cost. Pricing runs $1/$6 to $5/$30, 1M context. Catch: preview-only to about 20 organizations, US government first.
• Gemini 3.6 Flash, 3.5 Flash-Lite, 3.5 Flash Cyber (Google): fewer tokens for the same price, plus a security model that patches vulnerabilities via CodeMender. The community verdict on 3.6 Flash was blunt: twice as fast, 18% cheaper, precisely 0% smarter. Still no 3.5 Pro. And temperature, top_p and top_k are now deprecated and ignored, so sampling control is disappearing as an API surface.
• GLM-5.2 (Z.ai) held the top of the open-source rankings all week: MIT license, 1M context, 91.2% GPQA Diamond, 62.1% SWE-bench Pro. It is also the model Hugging Face reached for when US models refused the forensics work.

Chips and infra

• AMD Helios is in full production: 72 Instinct MI455X GPUs, 31TB HBM4 against Vera Rubin NVL72’s 20.7TB, 2.9 ExaFlops FP4. AMD claims 15% more peak compute and 30% more tokens per dollar, on open interconnects rather than NVLink, at roughly $5M a rack against Nvidia’s $3.5 to $4M. Microsoft, Meta (1GW by end-2026) and Oracle (50k GPUs from Q3) are named. Treat every number as vendor-supplied until someone independent runs them. (TechCrunch)
• PyTorch Monarch now runs on AMD GPUs, bringing single-controller distributed training to ROCm. Quietly more consequential for the CUDA moat than any rack announcement. (PyTorch)
• The inference-specialization bet keeps attracting money. Google is building a Gemini-specific inference chip targeting 6 to 10x more tokens per watt than current TPUs, and Etched raised $300M at a $10.3B valuation for transformer ASICs.

Deals and money

• Stripe is in talks to buy OpenRouter for around $10B (WSJ). OpenRouter was valued at $1.3B in May, so that is roughly an 8x markup in ten weeks. A payments company buying the model router is a bet that inference becomes a metered utility with billing as the choke point. (Yahoo Finance)
• Anthropic’s $1.5B copyright settlement was approved, the largest copyright recovery in US history at roughly $3,000 per book across about 500,000 authors. The precedent is now the de facto rulebook: training on legally acquired books is fair use, piracy gets paid for.
• Travis Kalanick’s Atoms raised $1.7B led by a16z for heavy-industry automation, Together AI took $800M at $8.3B, and Cognition acquired Poke, where the real asset is Poke’s Apple Messages Business Chat approval. Moonshot is reportedly heading to IPO at around $20B, up from $4.3B six months ago.

Consumer AI

• Shared Claude conversations are indexed by Google. 416 points and 148 comments of people discovering that public share links are public in the full sense. Worth auditing anything you have ever shared.
• OpenAI launched ChatGPT Ads. The monetization shoe drops. Claude voice mode rolled out across Opus, Sonnet and Haiku with tool access, plus “record a skill” screen recording on paid plans.
• The TECNO Camon 50 Ultra ships a $600 phone with an on-device agent that drives apps end to end and hard-stops at payments. Agent phones are arriving at the mid range first.

Research worth knowing

• Fable produced a counterexample to the Jacobian Conjecture, open for roughly 90 years: a three-variable polynomial map with single-digit coefficients, trivially checkable, verified by hand and by rival models. Kevin Buzzard’s line: “human mathematicians are being outcounterexampled.” Six open Erdős problems reportedly fell in five days on top of that.
• Google open-sourced a vector-compression algorithm that squeezes 31GB of RAG embeddings into 4GB. Directly relevant if you run large retrieval indexes.
• A study found AI advice made people 3x less accurate and 2x more confident. Useful counterweight the next time you are tempted to accept an agent’s summary without checking it. (TNW)

Worth your scroll

• “Open-weight AI is having its Kubernetes moment”, 296 points on HN.
• Claude Code silently deletes sessions older than 30 days by default, with no consent prompt.
• If your model writes the citation, it will eventually make one up. Give it an opaque ID and substitute the real reference yourself.
• A Claude Code skill that turns a photo of your handwriting into an installable font, 2.2k upvotes of pure delight.
• Kimi K3 built a working Windows XP in the browser. Not a benchmark, just fun.

What I’m watching next week

• July 27: Kimi K3’s full 2.8T weights land. The next flashpoint in the open-weights fight, and the first independent check on the benchmark claims.
• July 28: the MCP spec ships. Stateless core, Apps and Tasks extensions, twelve-month clock on the legacy protocol.
• August 19: Fable 5’s Claude Code access extension expires. Watch whether it converts into permanent metering.
• September 1: Sonnet 5’s intro discount ends, $2/$10 becomes $3/$15 per million tokens. If you run Sonnet as the cheap implementer under a smarter planner, re-run that math now.

---

The Agentic Engineer Weekly is the Saturday companion to the daily morning AI briefing I write for myself. AI agents. Not the hype. Real workflows.

Watch the video episodes on YouTube at @agenticlife-amit. Follow me on X and LinkedIn. If a friend forwarded this, forward it to one engineer who would like it. If you want to talk back, find me on any of those.