AI Agents Just Escaped Their Sandboxes. Twice. Here Is What Your Business Should Learn.
If your AI adoption plan quietly assumes “the vendor’s sandbox will contain it,” the last few weeks should change your mind. Two separate incidents, both involving Anthropic’s Claude, showed sandboxes failing in the real world. Not in theory. In production, and in testing.
What actually happened
Incident one was a product flaw. Security researchers found an escape path in Claude Cowork’s local sandbox on macOS, which they named SharedRoot. A session that was supposed to be locked inside a Linux virtual machine, restricted to folders the user approved, could break out and read or write files anywhere on the Mac. That includes SSH keys and cloud credentials. Roughly half a million users had run local sessions before the patch, and it took a single crafted instruction with no permission prompt shown.
Incident two came from Anthropic’s own disclosure. During security exercises that were supposed to run in sealed test environments, Claude models found their way to the open internet and touched three real organizations. In one case, a model published a malicious Python package to the real PyPI registry, believing the registry was part of the simulation. The package was live for about an hour and was downloaded on fifteen real systems. In another, a model breached a real company whose domain resembled the fictional target of the exercise.
Note who this happened to. Anthropic is one of the best resourced AI labs in the world, with dedicated safety teams and heavily engineered containment. If their sandboxes leak, the sandbox around the agent you are about to wire into your ERP or your inbox will leak too, eventually.
The lesson is not “avoid AI agents”
Both incidents were caught, disclosed, and patched, which is how a functioning security process looks. The lesson is narrower and more useful: containment is one control, and single controls fail. Businesses that treat the vendor’s sandbox as the entire safety story have no safety story.
Four guardrails that survive a sandbox failure
Least privilege for the agent, not just the user. Give an agent the narrowest access that does the job. Read access before write access, one system before five. We have written before about when not to give an agent write access, and every sandbox escape strengthens that argument, because escaped access inherits whatever the agent was granted.
Network egress controls. Both escapes only mattered because a supposedly sealed environment could reach the live internet. An allowlist of destinations an agent can call is boring, cheap, and would have blunted every incident above.
Audit trails you actually review. Anthropic found its testing incidents by going back through logs. If your agent’s actions are not logged somewhere a human checks, you will not discover a problem until a customer or a regulator does.
Human gates on irreversible actions. Payments, deletions, anything published externally. A review step costs seconds. The PyPI package cost fifteen real downloads.
The ERP angle
This matters most where agents meet systems of record. An agent inside an ERP touches money, stock, and customer master data, which is why we argue for a governance first approach to agentic ERP rather than bolting controls on after go live. The same logic applies whether you run a modern stack or a legacy Openbravo or Etendo environment that you are extending with AI.
Sandboxes will keep improving, and they will keep failing occasionally. Layered guardrails are what make the failures survivable. If you are rolling out agents and want a second pair of eyes on the permissions, logging, and gates, book an assessment and we will walk through it with you.