it’s not impossible, but it’s also not easy. it requires a lot of work. existing tech like firecracker has held up very well against current models, including gpt-6/mythos level models. completely blocking egress is relatively straightforward. things get much harder when the task requires constrained internet access, which is what led to most openai sanboc bypasses, but even then, it’s possible. BUT, the mistake would be assuming firecracker will also hold against something like gpt-7 or gpt-8, its literally the kind of assumption is how you end up with much more catastrophic hugging face style incidents. you need to assume firecracker can eventually be broken and build the surrounding system around that assumption. also, you need to assume a lot of controls we thought would hold will fail and build around it. and, lots of sandbox escape auditing with models and humans before you do large scale training or evals. it is never easy, if security or developer could anticipate every vulnerability beforehand and design things, security would be a solved problem, and there is a reason its not

thank you to all of our 1337 contributors 🤍