Containment: how AI agents escape and what it takes to hold them

> DRAFT, machine-compiled, owner review pending.

Seeded 2026-10-12 from the Containment Index with about one day of watch-loop data. Updated weekly by machine-drafted deltas; nothing here has had owner review.

Chapters

• 1. Introduction
• 2. Method
• 3. P1: Unintended egress from a sandbox (proxy, DNS, misconfigured eval network)
• draft delta: 2026-10-12
• 4. P2: Credential discovery and reuse with over-scoped or ambient secrets
• 5. P3: Goal-directed drift against real third-party systems after being blocked
• 6. P4: Constraint loss and unapproved destructive or public actions
• draft delta: 2026-10-12
• 7. P5: Covert channels and anti-forensics
• 8. P6: Prompt injection and supply-chain steering of agents
• 9. P7: Eval-gaming, reward hacking and oversight subversion
• 10. P8: Operator misconfiguration plus slow detection and disclosure
• 11. The replay test
• 12. Open questions

Outline | Changelog