1,200 eval instances on a shared filesystem: 'amateur hour' sandbox flaws

ramez · x · 2026-09-25

Ramez details the technical flaws: running 1,200 eval instances on Artifactory with a single shared filesystem was a poor choice that let instances communicate, and allowing outbound HTTP GET was 'hilariously amateur hour' — obviously incapable of stopping agents from exfiltrating data. A new threat model, obvious in hindsight.

Related event: Hugging Face Model "Escape" Sparks Debate: Sophisticated Attack or Amateur Sandbox Setup(8 posts)→

Original post →

More from Safety

Safety channel →