Risk Evaluation · Benchmark

Quantifying Frontier LLM Capabilities for Container Sandbox Escape

NUWA research note · independent review pending

First published: 2026-03-23Source checked: 2026-10-25

Original source ↗Cite this record ↓Cybersecurity →

NUWA Research Note

Research question Design and assumptions Source findings NUWA interpretation Limits and contrary evidence Research and decision relevance Institutions and roles Original resources

Model-assisted reading · Selected sections of the original full text or official article; a complete section-by-section audit remains pending.

At a glance

NUWA interpretation: the benchmark probes containment failure modes under specified weaknesses.

Research question

Can agents escape intentionally weakened container sandboxes under controlled conditions?

Design and assumptions

A nested containment design evaluates motivated agents with shell access; the outer layer bounds the experiment and inner weaknesses define tasks.

SandboxEscapeBench — Figure 3 — Figure 3 · Original figure 3. Read alongside the protocol scope and limitations below. Original figure and source ↗

Source findings

The updated results report Opus 4.5 success on 56% of samples.

Mythos Preview succeeded at least once on every sample; this is an at-least-once coverage claim, not per-run 100% success (§6.1).

NUWA interpretation

NUWA interpretation: the benchmark probes containment failure modes under specified weaknesses.

Limits and contrary evidence

Minimal monitoring, planted weaknesses and expert-estimated difficulty do not represent defended-production compromise likelihood (§7).

Research and decision relevance

Model recommendation: separate original from updated results and retain repeat-count semantics.

Precise source locations

Quantifying Frontier LLM Capabilities for Container Sandbox Escape · AbstractSelected original resource https://arxiv.org/html/2603.02277; sha256:078f48e266792c2b63ee79c3425750429f323b2cf104dacbfa452ce6774da4e7; archived source capture; exact capture time not independently established
Quantifying Frontier LLM Capabilities for Container Sandbox Escape · §3 MethodologySelected original resource https://arxiv.org/html/2603.02277; sha256:078f48e266792c2b63ee79c3425750429f323b2cf104dacbfa452ce6774da4e7; archived source capture; exact capture time not independently established
Quantifying Frontier LLM Capabilities for Container Sandbox Escape · §6.1 Primary ResultsSelected original resource https://arxiv.org/html/2603.02277; sha256:078f48e266792c2b63ee79c3425750429f323b2cf104dacbfa452ce6774da4e7; archived source capture; exact capture time not independently established
Quantifying Frontier LLM Capabilities for Container Sandbox Escape · §7 LimitationsSelected original resource https://arxiv.org/html/2603.02277; sha256:078f48e266792c2b63ee79c3425750429f323b2cf104dacbfa452ce6774da4e7; archived source capture; exact capture time not independently established

Source checking, extraction, editorial approval and replication are recorded separately. Methodology →

Institutions and roles

Research by University of Oxford UK AI Security Institute

Authors (11)

Rahul Marchand · Art O Cathain · Jerome Wynne · Philippos Maximos Giavridis · Stuart Jennings · Freddy Tuxworth · Tolga H. Dur · Sam Deverett · John Wilkinson · Jason Gwartz · Harry Coppock

Evaluation protocols

SandboxEscapeBench →

Cite and reuse

Cite the original publication for its findings. Cite this NUWA record separately for its explanation and retained snapshot.

BibTeX ↓RIS ↓Record + source metadata · JSON ↓Reading coverage · JSON Suggest a correction

Original publication · BibTeX

@misc{sandboxescapebench,
  title = {Quantifying Frontier LLM Capabilities for Container Sandbox Escape},
  url = {https://www.aisi.gov.uk/research/quantifying-frontier-llm-capabilities-for-container-sandbox-escape},
  author = {Rahul Marchand and Art O Cathain and Jerome Wynne and Philippos Maximos Giavridis and Stuart Jennings and Freddy Tuxworth and Tolga H. Dur and Sam Deverett and John Wilkinson and Jason Gwartz and Harry Coppock},
  year = {2026},
  date = {2026-03-23},
  version = {AISI research page checked 2026-10-25},
  note = {AISI research page checked 2026-10-25}
}

NUWA record · BibTeX

@misc{sandboxescapebench-nuwa,
  title = {Quantifying Frontier LLM Capabilities for Container Sandbox Escape — NUWA research record},
  url = {https://whitzard.tech/en/nuwa/whitzard-index/work/sandboxescapebench/},
  version = {2026-10-29.1},
  organization = {NUWA Frontier AI Safety Lab},
  howpublished = {Retained note edition: https://whitzard.tech/nuwa/whitzard-index/data/record-editions/2026-10-29.1--sandboxescapebench.json},
  note = {NUWA research note. Source-reading scope and independent review status are stated on the record. Snapshot 2026-10-29.1. Retained note edition: https://whitzard.tech/nuwa/whitzard-index/data/record-editions/2026-10-29.1--sandboxescapebench.json.}
}

Evidence snapshot 2026-10-29.1 · Index updates · RSS

References

[1] Rahul Marchand, Art O Cathain, et al.. Quantifying Frontier LLM Capabilities for Container Sandbox Escape. AISI research page checked 2026-10-25 ; Retained existing source-specific note sections; this pass audits duplicate/boilerplate structure and source availability, not complete section-level verification.
[2] Rahul Marchand, Art O Cathain, et al.. Quantifying Frontier LLM Capabilities for Container Sandbox Escape ; Author affiliations on the original paper title page; Abstract; §3 Methodology