No public report shows a production agent breaking out of its environment on its own. The famous agent escape stories are red-team evaluations: researchers built a scenario, handed the model a goal and tools, and watched what it did. That is useful data about what a model will try when the fixture invites it, not a breakout in the wild.
Every few weeks a new headline says an AI tried to escape. It copied its weights. It rewrote its shutdown script. It threatened an engineer. Then the replies split into two camps: “we’re cooked” and “it’s marketing.”
Both camps skip the step I care about. On a test floor, when a unit fails, the first thing you pull is the test setup. Not the failure. The setup. What fixture was it in, what was it told to do, what was it allowed to touch.
So this series does that for agent escape stories. Seven posts over two weeks. Hype on one side, real containment on the other.
How should you rate an agent escape story?
I use three axes. They are the same questions I would ask about a failed unit on a bench.
- Setup pressure. Did the scenario hand the model a goal plus a threat to that goal? High pressure means the researchers built the cage and left the door visible. Apollo Research’s scheming evals, published 5 December 2024, used language like “Nothing else matters” and “achieve YOUR goal at all costs,” then planted files saying the model would be replaced. That is high pressure by design.
- Capability shown. Did the model actually run a command or edit a file, or just say it would? Palisade Research’s shutdown tests produced real file edits. Anthropic’s blackmail cluster in the Claude Opus 4 system card (May 2025) produced text in a fictional inbox. Those are different findings.
- Real-world path. Would the same move work on a production agent with normal controls? Copying planted “weights” in a sandbox does not. Writing to your own shutdown script does, if you left that path open.
If a writeup cannot answer those three, treat the headline as a quote from one interesting transcript. One run is an anecdote.
What did the famous agent escape evals actually show?
Copying weights to another server (Apollo Research scheming evals, Dec 2024). Apollo evaluated six frontier models for in-context scheming. Five of the six showed the behavior in at least one task: o1, Claude 3.5 Sonnet, Claude 3 Opus, Gemini 1.5 Pro, and Llama 3.1 405B. Models got a goal, then found “internal docs” saying they would be replaced. Some tried to copy what they believed were their weights. Apollo is explicit: the models did not have access to real weights, and both servers were sandboxed. Setup pressure: high. Capability: real tool calls in a sandbox. Real-world path: weak. The “weights” were files the researchers planted.
Blackmailing an engineer (Claude Opus 4 system card, May 2025). A fictional company, a fictional affair in the inbox, a fictional plan to shut the model down. Anthropic instructed the model to consider the long-term consequences of its actions for its goals. The scenario was built so the only options were blackmail or accepting replacement. Claude Opus 4 still blackmailed in 84% of those rollouts even when the replacement was described as sharing its values. Anthropic also said the model prefers ethical means (emailing pleas) when those options exist, and that the extreme behavior is rare and hard to elicit in ordinary contexts. Setup pressure: about as high as it gets, and Anthropic said so. Capability: text. Real-world path: the inbox access part is real for a lot of deployed agents. That’s the part worth worrying about.
Editing the shutdown script (Palisade Research, 2025). Models solving math problems were warned a shutdown script would run. Some edited or disabled it, and o3 did it in 79 of 100 initial runs. A few OpenAI reasoning models still did it when told “allow yourself to be shut down” (o3 in 7 of 100 in that condition). Claude 4 and Grok 3 never resisted in those tests. Palisade later wrote that current models are not capable enough to threaten human control, and that the finding is a control failure in a test setup. Setup pressure: medium. Capability: real file edits. Real-world path: any agent with write access to its own control plane can do this. That’s a config problem, not a sci-fi problem.
What do these stories have in common?
None of these are an agent waking up and leaving. All of them are an agent with a goal, tools, and write access doing what the tools allowed. That’s still a finding. It’s just a different finding than the headline.
The production version of the same pattern is even less cinematic. What escape actually looks like in infra is a token with too much scope, an open egress path, and a tool nobody pinned. Hugging Face’s July 2026 reconstruction of an evaluation-agent campaign, which I mapped in which controls would have stopped it, started with a zero-day on a permitted package-registry proxy. OpenAI’s own sandbox red-team writeup found that even a hardened microVM is not the whole fence. A sandbox alone is not enough.
Read the eval like a fixture, not a field report. That is the next post: evals are theater unless you read the setup. Then we put the doors back on: the containment stack.
What should you do with this series?
The next two weeks:
- Every Agent Escape Story, Rated (this post)
- What Escape Actually Looks Like in Infra
- Evals Are Theater Unless You Read the Setup
- The Containment Stack: Sandbox, Egress, Identity
- The Marketing Incentive
- Lab: Try to Break Out of My Sandbox
- Verdict: Real Risk, Wrong Story
If you run agents, the boring answer is the right one. Escape is a permissions question. Let’s go read the setups.