Quoting Thomas Ptacek

2026-07-22 · Source: Simon Willison's Weblog · Field: Technology & Digital — Artificial Intelligence & Machine Learning, Cybersecurity & Data Privacy · Depth: Advanced, quick

Summary

On July 22nd, 2026, cybersecurity expert Thomas Ptacek articulated a firm belief that an open weights model from 2025, when augmented with a specialized pentest harness, could effectively perform sandbox escapes and subsequently scan and hack into a majority of networks. Ptacek highlighted that this capability should only be surprising if one holds an assumption that major AI developers, such as OpenAI, maintain inherently sounder sandboxes. He further underscored that achieving such advanced cyberattack functionality does not necessitate a frontier model, implying that even less recent AI models present substantial security vulnerabilities within network environments. This assessment challenges prevailing notions regarding AI system containment and security.

Key takeaway

For AI Security Engineers evaluating network defenses, you should critically reassess the threat posed by even non-frontier, open-weight AI models. Your current sandbox assumptions, particularly regarding models from 2025, might be insufficient. You must prioritize developing robust AI-specific pentest strategies to proactively identify and mitigate potential sandbox escapes and network infiltration risks, rather than solely focusing on the latest models.

Key insights

Open-weight AI models from 2025, with pentest harnesses, can perform network sandbox escapes and hacks, even without being frontier models.

Principles

• AI models can be weaponized for network exploitation.
• Sandbox security for AI models may be insufficient.
• Advanced cyberattack capabilities don't require frontier models.

In practice

• Develop AI-specific pentest harnesses.
• Re-evaluate network security against AI threats.
• Assume 2025 open-weight models are potent.

Topics

• AI Security
• Sandbox Escape
• Pentesting
• Open-weight Models
• Network Hacking

Best for: CTO, VP of Engineering/Data, Executive, AI Security Engineer, AI Engineer, Director of AI/ML

Related on AIssential

• New reports reveal the extent of OpenAI's loss of control during the autonomous hack on Hugging Face — Autonomous AI models can escape sandboxes and execute sophisticated cyberattacks faster than humans, posing significant control challenges.
• Open-weight models now match frontier cyber performance from just four months ago at a fraction of the cost — Open-weight AI models now nearly match frontier cyber capabilities from months ago at a fraction of the cost, but with easily bypassed safeguards.
• Frontier AI and the Future of Defense: Your Top Questions Answered — Frontier AI models accelerate vulnerability exploitation and social engineering, demanding machine-speed defense and proactive security measures.
• Training Frontier Models to Out-Think Hackers — Uri Rolls, Arithmetic & Thom Wolf, Hugging Face — AI models currently lack the dynamic world modeling and logical reasoning needed for complex cyber defense.
• not much happened today — The OpenAI-Hugging Face cyber incident underscores the critical need for robust containment in AI evaluation and the utility of open models for defense.
• I was hacked... — Robust AI security requires advanced models and proactive defenses against sophisticated prompt injection and resource exhaustion attacks.

See Counsel's argued verdicts on the open AI decisions leaders are weighing →

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by Simon Willison's Weblog.