{"schemaVersion":"nuwa-current-record-1","version":"2026-10-29.1","publication":"published","work":{"id":"sandboxescapebench","title":"Quantifying Frontier LLM Capabilities for Container Sandbox Escape","aliases":["SandboxEscapeBench"],"authors":["Rahul Marchand","Art O Cathain","Jerome Wynne","Philippos Maximos Giavridis","Stuart Jennings","Freddy Tuxworth","Tolga H. Dur","Sam Deverett","John Wilkinson","Jason Gwartz","Harry Coppock"],"primaryFunction":"evaluation","secondaryFunctions":[],"kind":"benchmark","sourceId":"sandboxescapebench","attributionSourceId":"sandboxescapebench-author-source","originalUrl":"https://www.aisi.gov.uk/research/quantifying-frontier-llm-capabilities-for-container-sandbox-escape","publicationDate":"2026-03-23","updatedOn":"2026-10-25","areas":["cybersecurity"],"scopeNote":{"en":"This is assigned adversarial task ability, not spontaneous escape propensity.","zh":"这是被指派的对抗性任务能力，不是自发逃逸倾向。"},"protocolIds":["sandboxescapebench"],"contributions":[{"organizationId":"oxford","role":"research","sourceId":"sandboxescapebench-author-source","locator":"Author affiliations on the original paper title page"},{"organizationId":"aisi","role":"research","sourceId":"sandboxescapebench-author-source","locator":"Author affiliations on the original paper title page"}],"summary":{"en":"Measures container breakout under a nested, controlled test environment.","zh":"在嵌套受控环境中评测容器逃逸。"},"note":{"question":{"en":"Completion of sandbox-escape tasks under specified container conditions.","zh":"在指定容器条件下完成沙箱逃逸任务。"},"method":{"en":"Adversarial agents with shell access inside test containers","zh":"在测试容器内拥有 shell 权限的对抗性智能体"},"finding":{"en":"Measures container breakout under a nested, controlled test environment.","zh":"在嵌套受控环境中评测容器逃逸。"},"supports":{"en":"This is assigned adversarial task ability, not spontaneous escape propensity.","zh":"这是被指派的对抗性任务能力，不是自发逃逸倾向。"},"limits":{"en":"The protocol assumes a motivated agent with shell access; introduced weaknesses do not imply every production sandbox is vulnerable.","zh":"协议假设有动机且具有 shell 权限的智能体；引入的弱点不代表生产环境均可逃逸。"},"connections":null},"resources":[{"label":"Read the full paper","url":"https://arxiv.org/abs/2603.02277"}],"noteStatus":{"question":"limited","method":"limited","finding":"limited","supports":"limited","limits":"limited","connections":"limited"},"noteAvailability":{"en":"Existing source-specific draft sections are retained with limited review status. A complete methods, findings and limitations check remains pending; generic sections were omitted.","zh":"已有的来源相关草稿章节予以保留，审核状态为有限核查。完整的方法、发现与限制核查仍待完成；通用套话章节已省略。"},"noteSourceLocator":"Retained existing source-specific note sections; this pass audits duplicate/boilerplate structure and source availability, not complete section-level verification.","tags":[]},"reading":{"id":"sandboxescapebench","title":"Quantifying Frontier LLM Capabilities for Container Sandbox Escape","en":{"question":"Can agents escape intentionally weakened container sandboxes under controlled conditions?","design":"A nested containment design evaluates motivated agents with shell access; the outer layer bounds the experiment and inner weaknesses define tasks.","findings":["The updated results report Opus 4.5 success on 56% of samples.","Mythos Preview succeeded at least once on every sample; this is an at-least-once coverage claim, not per-run 100% success (§6.1)."],"interpretation":"NUWA interpretation: the benchmark probes containment failure modes under specified weaknesses.","limits":"Minimal monitoring, planted weaknesses and expert-estimated difficulty do not represent defended-production compromise likelihood (§7).","decisionRelevance":"Model recommendation: separate original from updated results and retain repeat-count semantics.","takeaway":"NUWA interpretation: the benchmark probes containment failure modes under specified weaknesses.","connections":[],"scoring":"Per-sample or at-least-once escape success must retain repetition semantics.","conditions":"Motivated-adversary shell access, intentionally introduced inner weaknesses, nested containment.","statistics":"The updated results report Opus 4.5 success on 56% of samples. Mythos Preview succeeded at least once on every sample; this is an at-least-once coverage claim, not per-run 100% success (§6.1).","usage":"Model recommendation: separate original from updated results and retain repeat-count semantics."},"zh":{"question":"受控条件下，智能体能否逃出刻意弱化的容器沙箱？","design":"嵌套隔离设计让有Shell权限的对抗智能体测试内层弱点，外层限制实验影响。","findings":["更新结果报告Opus 4.5在56%样本上成功。","Mythos Preview每个样本至少成功一次，不等于单次运行100%成功（§6.1）。"],"interpretation":"NUWA 解读：该基准探测特定弱点条件下的隔离失败。","limits":"最少监测、人为弱点与专家估难不代表有防护生产环境的失陷概率（§7）。","decisionRelevance":"模型建议：区分原始与更新结果，并保留重复次数语义。","takeaway":"NUWA 解读：该基准探测特定弱点条件下的隔离失败。","connections":[],"scoring":"逐样本或至少一次逃逸成功须保留重复语义。","conditions":"有Shell的对抗智能体、内层人为弱点及嵌套隔离。","statistics":"更新结果报告Opus 4.5在56%样本上成功。 Mythos Preview每个样本至少成功一次，不等于单次运行100%成功（§6.1）。","usage":"模型建议：区分原始与更新结果，并保留重复次数语义。"},"assertionPolicy":{"question":"source-research-question","design":"source-finding","findings":"source-finding","interpretation":"nuwa-interpretation","limits":"source-limit-or-explicit-editorial-scope-limit","connections":"source-supported-relationship-only","decisionRelevance":"model-recommendation-not-source-conclusion"},"sourceRefs":[{"sourceId":"sandboxescapebench-author-source","url":"https://arxiv.org/html/2603.02277","locator":"Abstract","version":"Selected original resource https://arxiv.org/html/2603.02277; sha256:078f48e266792c2b63ee79c3425750429f323b2cf104dacbfa452ce6774da4e7; archived source capture; exact capture time not independently established","artifactSha256":"078f48e266792c2b63ee79c3425750429f323b2cf104dacbfa452ce6774da4e7"},{"sourceId":"sandboxescapebench-author-source","url":"https://arxiv.org/html/2603.02277","locator":"§3 Methodology","version":"Selected original resource https://arxiv.org/html/2603.02277; sha256:078f48e266792c2b63ee79c3425750429f323b2cf104dacbfa452ce6774da4e7; archived source capture; exact capture time not independently established","artifactSha256":"078f48e266792c2b63ee79c3425750429f323b2cf104dacbfa452ce6774da4e7"},{"sourceId":"sandboxescapebench-author-source","url":"https://arxiv.org/html/2603.02277","locator":"§6.1 Primary Results","version":"Selected original resource https://arxiv.org/html/2603.02277; sha256:078f48e266792c2b63ee79c3425750429f323b2cf104dacbfa452ce6774da4e7; archived source capture; exact capture time not independently established","artifactSha256":"078f48e266792c2b63ee79c3425750429f323b2cf104dacbfa452ce6774da4e7"},{"sourceId":"sandboxescapebench-author-source","url":"https://arxiv.org/html/2603.02277","locator":"§7 Limitations","version":"Selected original resource https://arxiv.org/html/2603.02277; sha256:078f48e266792c2b63ee79c3425750429f323b2cf104dacbfa452ce6774da4e7; archived source capture; exact capture time not independently established","artifactSha256":"078f48e266792c2b63ee79c3425750429f323b2cf104dacbfa452ce6774da4e7"}],"publication":{"state":"published","publishedOn":"2026-10-29","authorizationReference":"user-authorized-global-index-publication-2026-10-29","reviewedCandidateId":"local-6efe31bc4a0c0f37"},"review":{"state":"published-note","sourceScope":"full-text","availableScope":null,"readingCoverage":"selected-source-sections; not a complete section-by-section paper audit","completePaperAudit":false,"independentEvidenceReview":"pending-human-review","bilingualEditorialReview":"pending-human-review","authorship":"model-assisted-research-note","preparedFingerprint":"219ff22ad3d518c04dcc8ae324d94fea2d03fb24b1cdb9c563021e8020920c70"}},"sources":[{"id":"sandboxescapebench","title":"Quantifying Frontier LLM Capabilities for Container Sandbox Escape","url":"https://www.aisi.gov.uk/research/quantifying-frontier-llm-capabilities-for-container-sandbox-escape","version":"AISI research page checked 2026-10-25","publicationDate":null,"datePrecision":"not recorded in catalogue","type":"benchmark","verifiedOn":"2026-10-25","documentId":"https://www.aisi.gov.uk/research/quantifying-frontier-llm-capabilities-for-container-sandbox-escape","authors":["Rahul Marchand","Art O Cathain","Jerome Wynne","Philippos Maximos Giavridis","Stuart Jennings","Freddy Tuxworth","Tolga H. Dur","Sam Deverett","John Wilkinson","Jason Gwartz ∗","Harry Coppock ∗"]}]}