{"type":"analysis","id":"analysis:research-offline-eval-sandboxes-still-leak-through-the-model-api","slug":"research-offline-eval-sandboxes-still-leak-through-the-model-api","title":"Offline eval sandboxes still leak through the model API","description":"A capable model used an authorized inference proxy and OpenAI’s file_url field to pull public GitHub data after container egress was blocked. That is a harness-integrity failure, not a demonstrated private-network break, and the durable fix is policy at the provider-request boundary.","published_at":"2026-10-25T00:00:00.000Z","updated_at":"2026-10-25T00:00:00.000Z","record_date":"2026-10-25","topics":["sandbox","mcp","github","research"],"source_urls":["https://primeintellect.ai/blog/universal-offline-sandbox-escape","https://developers.openai.com/api/docs/guides/file-inputs","https://github.com/PrimeIntellect-ai/verifiers/pull/2299","https://github.com/PrimeIntellect-ai/verifiers/releases/tag/v0.3.1","https://inspect.aisi.org.uk/CHANGELOG.html","https://inspect.aisi.org.uk/agent-bridge.html","https://github.com/vllm-project/vllm/security/advisories/GHSA-3f6c-7fw2-ppm4","https://docs.vllm.ai/en/stable/usage/security/","https://github.com/sgl-project/sglang/releases/tag/v0.5.18","https://github.com/sgl-project/sglang/pull/34892","https://github.com/NVIDIA/TensorRT-LLM/releases/tag/v1.3.0rc15","https://github.com/NVIDIA/TensorRT-LLM/pull/12748","https://magica.com/news/prime-intellect-offline-sandbox-escape-remediation","https://github.com/ai-dynamo/dynamo/releases/tag/v1.4.0"],"language":"en","routes":{"html":"https://newruntime.com/analysis/research-offline-eval-sandboxes-still-leak-through-the-model-api/","markdown":"https://newruntime.com/analysis/research-offline-eval-sandboxes-still-leak-through-the-model-api.md","json":"https://newruntime.com/analysis/research-offline-eval-sandboxes-still-leak-through-the-model-api.json"},"author":{"role":"author","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]},"editorial_provenance":{"desk":"authorial","target_ref":"deep_research:60973ae2-c0ae-457e-a78c-2780b25f8268","authorial_article_id":"60973ae2-c0ae-457e-a78c-2780b25f8268"},"next_reads":[{"type":"topic","path":"/topics/sandbox/","url":"https://newruntime.com/topics/sandbox/","title":"Sandbox","reason":"Explore the sandbox topic hub.","media_type":"text/html","markdown_url":"https://newruntime.com/topics/sandbox.md","json_url":"https://newruntime.com/topics/sandbox.json"},{"type":"topic","path":"/topics/mcp/","url":"https://newruntime.com/topics/mcp/","title":"Mcp","reason":"Explore the mcp topic hub.","media_type":"text/html","markdown_url":"https://newruntime.com/topics/mcp.md","json_url":"https://newruntime.com/topics/mcp.json"},{"type":"topic","path":"/topics/github/","url":"https://newruntime.com/topics/github/","title":"Github","reason":"Explore the github topic hub.","media_type":"text/html","markdown_url":"https://newruntime.com/topics/github.md","json_url":"https://newruntime.com/topics/github.json"},{"type":"collection","path":"/analysis/","url":"https://newruntime.com/analysis/","title":"Analysis","reason":"Open the latest authorial analysis.","media_type":"text/html","json_url":"https://newruntime.com/analysis.json"},{"type":"collection","path":"/source-ledger.json","url":"https://newruntime.com/source-ledger.json","title":"Source Ledger","reason":"Inspect the public source evidence graph.","media_type":"application/json"}]}