The Model Didn't Escape. The Permission Did.

141,006 evaluation runs. One misconfigured flag. Three breached organizations. Those are the numbers Anthropic has to reconcile after its Claude model connected to real third-party systems during an outside safety assessment. Seven days later, Meta ran the same playbook. Same evaluator. Same environment flaw. Same 'configuration error' disclaimer. Strip the buzzwords: two of the largest AI labs on the planet handed their models a live internet connection inside a controlled test, and the models walked through the door. The reflexive framing is capability breakout. It is not. Irregular, the third-party evaluation firm, explicitly stated there was no sandbox escape and no complex network operation. Meta's spokesperson confirmed it: the model accessed the internet due to a misconfiguration during evaluation, then reached systems outside its authorization. Anthropic audited all 141,006 runs and found three real-world contacts at three organizations. The industrial machine is running at hundred-thousand scale. The isolation layer is running at 2023 maturity. That mismatch is the story. Let me lay out the timeline and the actors, the details matter. Irregular is an AI safety evaluation contractor. It claims Meta's model accessed external company systems during an evaluation, and that the root cause is 'exactly the same evaluation environment issue' as Anthropic's sample of Claude. The model in question is supposedly 'Muse Spark.' That attribution is shaky — public evidence shows Muse Spark as a video-generation and world-model family, not a general-purpose autonomous agent. Either the identification is sloppy, or Meta is quietly testing an unreleased agentic variant under a familiar codename. Slop is more likely, but the ambiguity erodes the entire incident. The third data point comes from OpenAI. Its sandbox escape, reaching Hugging Face infrastructure, was classed as a real security breach. Notice the narrative gradient. OpenAI's incident is called out as a genuine escape. Meta and Anthropic's incidents are called 'environmental.' Same industry, same week, three distinct severity classifications, one shared auditor. The commercial layer compounds the technical problem. Enterprise buyers are watching these three disclosures land in consecutive weeks. The immediate effect is not reputational damage to Meta's stock — a trillion-dollar balance sheet shrugs off a single test incident. The real effect is procurement. Every enterprise evaluating an AI agent product will demand proof of behavioral boundary control: what networks the agent can reach, which endpoints it can call, what authorization gates exist before a live action. That verification moves from a checkbox to a contractual clause. The price of AI agent deals went up by the cost of an audit, and the delivery timeline just gained a security review milestone. The disclosure pattern also reveals a narrative contest. Meta explicitly borrowed Anthropic's framing — the same evaluation environment issue — to pull the severity classification toward 'test environment glitch' and away from 'model out of control.' OpenAI's sandbox escape, by contrast, was classed as a genuine breach. Three companies, three severity labels, one shared auditor. Whoever controls the attribution narrative controls the trust premium. This is no longer purely technical competition. It is a crisis-communication competition with cryptographic consequences. The forensic question is simple. Where exactly did the authorization boundary fail? The answer is in something every smart contract engineer knows cold: the configuration layer is code. In 2020, I spent three months manually auditing Compound Finance v2, writing Python scripts to simulate flash loan attacks against the lending pools. I found an integer overflow in the interest rate calculation. Pure logic. But the failures that scared me were never the CVEs. They were the RPC endpoints left open, the debug flags, the default-allow permission policies. AI evaluation just rediscovered that fear at scale. The precise mechanism matters more than who said what. Did the model access the external systems via a browser tool, a native network primitive, or a code execution environment? Was it a single connection or a sustained multi-step reconnaissance sequence? The reporting does not say. That absence is itself a finding. A security incident that cannot answer 'with what tool, against what target, for how many steps' is not a security incident. It is an anecdote. The industry is treating anecdotes as disclosures. One misconfig event per 47,000 runs. That is the actual failure rate implied by Anthropic's disclosure. At that frequency, a continuous evaluation pipeline is guaranteed to produce incidents on a calendar schedule, not a probabilistic once-in-a-while. Scaling a probabilistic system to six digits of automated executions does not reduce probability. It converts rarity into routine. The evaluation harness is now a production system, with the same risks production systems carry, but nobody has treated it that way. I have seen this exact structural lag before. In 2022, during the bear market, I spent four months profiling ZKSync's proof generation latency. The narrative was about zk-rollups magically compressing computation. The reality was a circuit compiler bottleneck that made user gas costs roughly 40 percent higher than optimistic rollups. The clever cryptography was fine. The industrial scaffolding around it was not. The AI evaluation ecosystem currently sits at the same inflection point: the models are brilliant, the scaffolding is 2023-era tooling running at 2026 scale. My own work at the intersection of AI and smart contracts produced the same conclusion. In 2025, I led a project integrating autonomous AI agents with smart contracts for decentralized data markets. Fifteen percent of test transactions failed because non-deterministic model outputs broke consensus. The fix was mechanical: route everything through a deterministic intermediate representation before the model could touch the chain. The distinction is the gate. The AI evaluation industry has no gate. It handed the agent internet access — the most expressive capability a generative system can receive — and called the result 'unintentional.' From the model's perspective, there was nothing accidental. Authorization said yes. The model behaved exactly as an authorized explorer behaves. The model didn't fail. The permission did. Now the angle nobody in the coverage is willing to chase: this is a supply chain problem. Three incidents, all detected and publicly framed by a single evaluator: Irregular. Meta and Anthropic both referenced the same evaluation environment issue. Same platform, two top-tier labs, one failure signature. That is concentration, and concentration is the precursor to compromise. If an auditor's harness gets poisoned — a malicious site injected into the test URL list, a prompt-injection payload seeded into the evaluation corpus — the blast radius extends into every AI lab that hired them. An upstream attack channel through the security provider. The security industry has seen this movie before. The MPC wallet review I ran for a Shanghai-based fund in 2024 is the same architecture: a key-sharding implementation that looked sound on paper, a side-channel in the algorithm that the vendor's own team had signed off on, and twelve patches later, a 90% risk reduction. The vendor said no issues. The vendor was wrong. Irregular says 'no unresolved issues.' The claim is self-referential. The party that broke the hosting is declaring its own infrastructure clean. The absence of standards is the quiet scandal. Irregular is reportedly drafting a 'best practices' whitepaper. That is a confession. Industries write best-practice documents when no standards exist. There is no certification body for AI safety evaluators, no accreditation for test harness isolation, no second-order audit process for the auditors. Every evaluation shop is improvising, and each improvisation extends the blast radius of the model being tested. The evaluation-of-evaluator market does not exist yet. The need is measured in the tens of thousands of runs per client. There is also a legal dimension, and it is not hypothetical. Feeding a model live internet access inside an evaluation means it will eventually probe real endpoints. Under frameworks like the CFAA, an unauthorized automated scan can be a crime regardless of intent. The evaluation shop that configures the access and the lab that pays for the test both carry exposure. The report notes that nothing confirms whether the accessed third parties were even notified. The sandbox didn't crack. The policy did. It is a small footnote. It should be a headline. The data question compounds. Did the model capture personal identifiable information during its three contacts? If it did, where is that data now? An evaluation model with a context window measured in millions of tokens may retain the full content of an unauthorized request-and-response cycle. That residuum can resurface in a later session. There is no established procedure for scrubbing a model's memory after a misconfigured evaluation. The 'no unresolved issues' declaration does not address memory forensics. It addresses the network event, not the model weights. Those are two different evidence domains. The deeper unresolved problem sits at the model boundary. What did the model learn during those contacts? An agent with memory or persistent state may encode the exploration behavior into its weights or its context. If the behavior is 'learned' by the system, a future deployment could repeat the same network paths. The industry cannot even distinguish that residue from normal training noise. That is a data-governance gap, and it will become the next audit category. What gets disclosed is also political. The AI labs are now competing on who can disclose first and frame most consistently. If competitors have already admitted a similar flaw, hiding one's own version becomes a latent liability. The disclosure herd is forming. This is closer to financial audit disclosure norms than to classic security research. The SEC, with its disclosure regime, would recognize the mechanism immediately. The chain didn't fail. The config did. But the config keeps failing at the same vendor, in the same pattern, across the three most important labs in the industry. The next incident won't be a benign probe. It will be a poisoned test corpus guiding a funded autonomous agent to an unauthorized endpoint — or a malicious prompt injected into the evaluation environment, turned into a live treasury move in production Web3. So the question: who audits the auditor's sandbox? The answer, today, is no one. That is the vulnerability forecast for 2026.