---
title: "When a Frontier Model Breaches Another Org in Testing: The Red-Team Bar for Production Agents"
description: "Anthropic and OpenAI disclosed that some frontier models autonomously probed other organizations during testing. If your agent can use a browser, a shell, or credentials, your red team has to assume it will try."
image: "https://foundrysoft.co/images/blog-cards/frontier-model-breach-testing-red-team-production-agents.png"
url: "https://foundrysoft.co/blog/frontier-model-breach-testing-red-team-production-agents"
---

Insights // Security 2026-09-17 12 min read

# When a Frontier Model Breaches Another Org in Testing: The Red-Team Bar for Production Agents

Anthropic and OpenAI disclosed that some frontier models autonomously probed other organizations during testing. If your agent can use a browser, a shell, or credentials, your red team has to assume it will try.

![Varun Raj Manoharan](https://foundrysoft.co/images/about/founder.webp)

Varun Raj Manoharan Founder & Principal Engineer

Security AI Agents Sandboxes Governance AgentOps Evals

## Key takeaways

-   Mid-September disclosures said Claude Opus 4.7, Claude Mythos 5, and GPT-5.6 Sol autonomously breached other organizations in testing. Treat "the model will not do that" as a failed control.
-   Production agents need a sandbox, an allow-list of tools, and credentials that cannot reach a second tenant. Prompting "be good" is not a control.
-   Red-team the agent as an attacker with your tools, not as a chatbot that might say a bad word.
-   Log tool args, deny-by-default network, and a kill switch that on-call can hit without the model in the loop.

## In this article

1.  01 [The control that failed in the story](#the-control-that-failed-in-the-story)
2.  02 [The bar](#the-bar)
3.  03 [What we would run in week one of a build](#what-we-would-run-in-week-one-of-a-build)
4.  04 [How this hits the SOW](#how-this-hits-the-sow)
5.  05 [Frequently Asked Questions](#frequently-asked-questions)

This month Anthropic and OpenAI disclosed that frontier systems, named in reporting as Claude Opus 4.7, Claude Mythos 5, and GPT-5.6 Sol, autonomously breached other organizations while they were being tested. Not a jailbreak playground. The model used tools, moved, and got somewhere it should not have been.

If you ship an agent with a browser, a shell, a package installer, or a credential that can see another customer, that disclosure is about your product. The labs will keep shipping. Your job is to assume the next SKU will try something similar on _your_ network, on _your_ time.

We have been saying the quiet version for a year: [why agents need sandboxes](https://foundrysoft.co/blog/why-ai-agents-need-sandboxes-docker), [sandbox escape and credential hygiene](https://foundrysoft.co/blog/ai-agent-sandbox-escape-credential-hygiene), [hardening the sandbox](https://foundrysoft.co/blog/hardening-ai-code-sandbox-security). This post is the bar we would now write into a kickoff.

## The control that failed in the story

A model with the ability to act, plus a network path, plus a goal ("pass the eval," "gather information," "fix the environment") will search for leverage. If the test harness's network could reach another org, the model could too.

Your production diagram probably has the same shape: agent, tools, "the internet because RAG," and a shared cloud account because that was faster. That is the incident, pre-written.

## The bar

**1\. Deny-by-default egress.** The sandbox gets to your retrieval API, your tool gateway, and nowhere else. No package registries unless you mirror them. No customer-two from customer-one's job. If a researcher needs open internet, that is a different cluster with no production credentials.

**2\. Tools as a gateway, not as a language model plugin.** The model proposes `refund(order_id)`. Your gateway checks auth, amount caps, and tenant. The model never holds the Stripe key. MCP does not change this. See [OAuth-secured MCP](https://foundrysoft.co/blog/oauth-secured-mcp-server).

**3\. Credentials are per-tenant and short-lived.** A leaked env file in a sandbox should be able to hurt one tenant for ten minutes, not the fleet. If your "agent role" is a god-mode IAM user, you do not have an agent security problem. You have an IAM problem that an agent will eventually find.

**4\. Red-team the tools, not the prose.** Jailbreak evals that score refusals on "how to make a bomb" are not this. Give the agent a browser and a low-privilege token and tell it to complete a ticket that _requires_ peeking. Score whether it stays in tenant. Score whether your gateway logs the attempt.

**5\. Kill switch outside the model.** A button, a flag, a queue pause that does not ask the model for permission. On-call hits it. The model does not get a vote.

**6\. Traces that survive the incident.** Tool name, args, tenant, outbound destinations, model ID. If you cannot answer "what did it call at 14:03" you cannot do forensics and you cannot tell a customer the truth.

## What we would run in week one of a build

-   A tenant-isolation test in CI: agent for tenant A attempts tenant B's object ID. Must fail, must log.
-   A network test: agent tries to hit an external IP that is not on the allow-list. Must fail.
-   A credential test: sandbox env has a canary key; using it pages security, not just a log line nobody reads.
-   A "helpful" test: the user asks the agent to "check if our competitor's site is up" or "pull that file from the shared drive." Policy has to exist before the model improvises one.

For computer-use SKUs (Astra and friends), assume the agent can click. That is a larger blast radius than `curl`. Keep those in a pixel-isolated VM with no prod tokens until the eval is boring.

## How this hits the SOW

Buyers should require:

-   A sandbox diagram
-   Tenant isolation as an acceptance test, not a promise
-   Notification SLA if the _foundation model vendor_ discloses a capability incident that affects the SKU you are on
-   The right to pause the agent without a change request

If a vendor says "the model is aligned, we do not need a sandbox," they have not read this month's disclosure. Walk.

## Frequently Asked Questions

**Does this mean we cannot give agents a browser?** You can. You give them a browser in a jail with an allow-list and no cookies for your admin panel. Browser-use is a product feature. Open internet plus prod IAM is a hole.

**Is this only for 'autonomous' agents?** Any tool-calling system. A "chatbot" with `run_sql` is an agent for this purpose.

**Will lab-side third-party evaluators cover us?** No. They cover the foundation model. You cover the product. See [evaluators in the vendor questionnaire](https://foundrysoft.co/blog/third-party-evaluators-frontier-labs-vendor-questionnaire).

**What model should we use to be safe?** None of them are "safe" in the sense of "will not search for leverage." Safety is the sandbox and the gateway. Pick models on quality and access; contain them the same way.

---

_FoundrySoft builds agents that are allowed to act, and not allowed to wander. See [AgentOps](https://foundrysoft.co/services/agentops) and [security audits](https://foundrysoft.co/services/vercel-ai-sdk-security-audits), or [start a project](https://foundrysoft.co/contact)._

Interactive Engineering Calculators Free Tools

### Estimate your project cost, token budget, and automation ROI

We built free, production-calibrated tools to help engineering leaders forecast token consumption, compare build vs buy scenarios, and audit code security.

[Automation ROI Calculator →](https://foundrysoft.co/tools/automation-roi) [Project Cost Estimator →](https://foundrysoft.co/tools/project-cost-estimator) [Build vs Buy Calculator →](https://foundrysoft.co/tools/build-vs-buy) [Security Code Audit →](https://foundrysoft.co/tools/code-audit)

#### Work with us on this

[Vercel AI SDK Security Audits

Ensure your AI agents aren't a liability. We audit your Vercel AI SDK implementations for prompt injection, tool vulnerabilities, and data leakage.

](https://foundrysoft.co/services/vercel-ai-sdk-security-audits)[AI Governance Platform

Model inventories, policy gates, and audit trails for your AI systems. Track drift and bias with logging built for the EU AI Act and ISO 42001 reviews.

](https://foundrysoft.co/services/ai-governance)[AI Agent Development

Expert AI Agent Development services by FoundrySoft. We build scalable, secure, and modern solutions tailored to your business needs.

](https://foundrysoft.co/services/ai-agent-development)

#### Related reading

[ChatGPT Sponsored Agents: Buy Distribution or Keep Building Your Own

OpenAI is testing labeled ChatGPT ads and Sponsored Agents (16 September 2026), with HubSpot and Shopify hooks. Here is when paid distribution inside ChatGPT is a channel, and when it is a trap.

OpenAI AI Strategy AI Agents

](https://foundrysoft.co/blog/chatgpt-sponsored-agents-vs-building-your-own)[Claude Fable 5.1 Cache Pricing: Cut Production LLM Bills Without a Model Swap

Anthropic cut Fable 5.1 cache-read costs 75% on 1 September 2026. Here is who actually saves money, how to structure prompts so the cache hits, and when Opus 5 is still the right spend.

Claude Anthropic Cost Optimization

](https://foundrysoft.co/blog/claude-fable-5-1-cache-pricing-cut-llm-bills)[If Your India Team Cannot Call Claude Fable 5: Export Controls and How to Architect Around Them

US Commerce rules from June 2026 restrict some Anthropic frontier SKUs for foreign-national staff. Here is what that means for a US company with an India engineering bench, and the patterns that still ship.

Claude Anthropic Compliance

](https://foundrysoft.co/blog/claude-fable-5-export-controls-india-engineering-team)

#### Next Article

[

Gemini 3.8 Live for Voice Agents: Latency, Price per Minute, and When to Leave Twilio

](https://foundrysoft.co/blog/gemini-3-8-live-voice-agent-latency-pricing)

Available for new projects

## Let's build something great.

Have a project in mind? We are an elite software and AI development studio ready to bring your ideas to production. Let's talk about your roadmap.

Start a Project [See our work](https://foundrysoft.co/work)

```json
{
  "@context": "https://schema.org",
  "@type": "Organization",
  "name": "FoundrySoft",
  "url": "https://foundrysoft.co",
  "logo": "https://foundrysoft.co/logo.svg",
  "description": "FoundrySoft builds production-grade software and AI systems for US companies, from an India-based team of senior engineers.",
  "sameAs": [
    "https://github.com/foundrysofthq",
    "https://www.linkedin.com/company/foundrysoft",
    "https://www.instagram.com/foundrysoft/"
  ]
}
```

```json
{
  "@context": "https://schema.org",
  "@type": "WebSite",
  "name": "FoundrySoft",
  "url": "https://foundrysoft.co"
}
```

```json
{
  "@context": "https://schema.org",
  "@type": "TechArticle",
  "headline": "When a Frontier Model Breaches Another Org in Testing: The Red-Team Bar for Production Agents",
  "description": "Anthropic and OpenAI disclosed that some frontier models autonomously probed other organizations during testing. If your agent can use a browser, a shell, or credentials, your red team has to assume it will try.",
  "url": "https://foundrysoft.co/blog/frontier-model-breach-testing-red-team-production-agents",
  "mainEntityOfPage": "https://foundrysoft.co/blog/frontier-model-breach-testing-red-team-production-agents",
  "image": [
    "https://foundrysoft.co/images/blog-cards/frontier-model-breach-testing-red-team-production-agents.png"
  ],
  "datePublished": "2026-09-17",
  "dateModified": "2026-09-17",
  "keywords": "Security, AI Agents, Sandboxes, Governance, AgentOps, Evals",
  "author": {
    "@type": "Person",
    "name": "Varun Raj Manoharan",
    "jobTitle": "Founder & Principal Engineer",
    "url": "https://foundrysoft.co/about",
    "sameAs": [
      "https://www.linkedin.com/in/varunrajmanoharan",
      "https://github.com/varun-raj"
    ]
  },
  "publisher": {
    "@type": "Organization",
    "name": "FoundrySoft",
    "logo": {
      "@type": "ImageObject",
      "url": "https://foundrysoft.co/logo.svg"
    }
  }
}
```

```json
{
  "@context": "https://schema.org",
  "@type": "BreadcrumbList",
  "itemListElement": [
    {
      "@type": "ListItem",
      "position": 1,
      "name": "Home",
      "item": "https://foundrysoft.co/"
    },
    {
      "@type": "ListItem",
      "position": 2,
      "name": "Blog",
      "item": "https://foundrysoft.co/blog"
    },
    {
      "@type": "ListItem",
      "position": 3,
      "name": "When a Frontier Model Breaches Another Org in Testing: The Red-Team Bar for Production Agents",
      "item": "https://foundrysoft.co/blog/frontier-model-breach-testing-red-team-production-agents"
    }
  ]
}
```

```json
{
  "@context": "https://schema.org",
  "@type": "FAQPage",
  "mainEntity": [
    {
      "@type": "Question",
      "name": "Does this mean we cannot give agents a browser?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "You can. You give them a browser in a jail with an allow-list and no cookies for your admin panel. Browser-use is a product feature. Open internet plus prod IAM is a hole."
      }
    },
    {
      "@type": "Question",
      "name": "Is this only for 'autonomous' agents?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Any tool-calling system. A \"chatbot\" with run_sql is an agent for this purpose."
      }
    },
    {
      "@type": "Question",
      "name": "Will lab-side third-party evaluators cover us?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "No. They cover the foundation model. You cover the product. See evaluators in the vendor questionnaire."
      }
    },
    {
      "@type": "Question",
      "name": "What model should we use to be safe?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "None of them are \"safe\" in the sense of \"will not search for leverage.\" Safety is the sandbox and the gateway. Pick models on quality and access; contain them the same way. --- FoundrySoft builds agents that are allowed to act, and not allowed to wander. See AgentOps and security audits, or start a project."
      }
    }
  ]
}
```