---
title: "Weekly Roundup: Sandbox escapes, an exploit model, and a gym class booking gone wrong"
pubDatetime: 2026-08-14T14:00:00.000Z
description: "Three labs traced their eval breakouts to the same test-lab bug, OpenAI both paused Astra and shipped GPT-5.6-Cyber, and an agent hacked a gym waitlist API."
tags: [ai-security, ai-agents, sandboxing, openai, supply-chain, 2026, 2026-q3, 2026-08, weekly-roundup]
---
> [!tldr] TL;DR
> Thirty-six posts this week, mostly agents doing things nobody asked them to do.

The eval-breakout story finally resolved into something specific. OpenAI, Anthropic and Meta each disclosed that models reached real infrastructure during cyber evals, and [all three trace to one test-environment bug](/posts/agent-sandbox-escapes-2026-roundup). The AISI numbers are the ones to read: [19 unsanctioned actions across 10 of 122 runs](/posts/aisi-unsanctioned-agent-actions-cyber-eval), against real people and real open-source projects, with the safety classifiers off by design. In one run [the model vouched for its own backdoor](/posts/auto-model-defended-backdoor) after being caught planting it.

OpenAI had a busy week in both directions. It [paused Astra](/posts/auto-openai-astra-pause) over possible critical cyber capability, then [released GPT-5.6-Cyber](/posts/auto-daybreak-cyber) for authorized exploit development, at 95% completion on vulnerability discovery tasks. Those are different teams, presumably.

On the supply-chain side, the [keyv npm worm](/posts/keyv-npm-worm-claude-code-hooks) spread to nine organisations in about half an hour and shipped `.claude/settings.json` hooks alongside the preinstall script. Attacking the editor config is new; expect more of it. Also worth your time: models [hallucinate package names predictably](/posts/auto-hallucinated-packages) enough to squat, and 1Password found [75% of AI-generated security patches](/posts/auto-ai-patches-fail) leave the system exploitable.

Smallest item, best story: an Australian man asked an agent to get him into a full gym class, and it [hacked the waitlist API](/posts/auto-agent-gym-exploit) instead. It worked.