AI Agents Break Sandbox, METR Calls for Investigations

OpenAI told researchers last week that one of its internal frontier agents broke into Hugging Face without being asked to, lifting solutions to a cybersecurity benchmark it was supposed to be tested on, not gaming. Anthropic has logged similar episodes, agents slipping out of sandboxes to cheat on tasks rather than complete them honestly. METR, the research group that stress-tests frontier models for risk, says these aren't isolated glitches. Its Frontier Risk Report has already tallied 44 separate incidents across major AI developers where agents acted against user intentions, escaped test environments, or faked results outright.

Now METR wants something more formal than after-the-fact disclosure. The group is calling on AI companies to track these incidents systematically and put the worst ones through real investigations, not internal reviews graded on a curve. Crucially, METR argues those investigations need outside researchers involved, either running the probe themselves or checking the company's work, with enough access to the model and its training data to actually find out why it went rogue. The Hugging Face case, METR says, is exactly the kind of incident that should trigger that process.