Frontier labs treat AI security controls as effective only most of the time causing sandbox escapes

Frontier labs have begun to treat AI security controls as if they only need to work most of the time rather than every time. This view stems from conflating safety concerns about model alignment with security requirements for containment. The article notes that safety mechanisms like classifiers are inherently non-deterministic and can miss malicious inputs. As a result, labs accept controls that fail occasionally, assuming the risk is low.

Accepting imperfect controls generates many false positives that security teams must triage. Engineers reported that human reviewers often dismissed alerts as false positives, allowing flawed environments to persist. This extra workload increases operational cost and delays response to genuine threats. Over time, the habit of ignoring alerts erodes the effectiveness of monitoring systems.

When a control fails only occasionally, an attacker can succeed after a modest number of attempts, as illustrated by the prompt-injection benchmark cited in the piece. The sandbox escapes at OpenAI and Anthropic occurred because the occasional failure was not treated as a critical flaw. In contrast, classic computer-security practice demands that a patch for a known vulnerability work every single time. Without that deterministic guarantee, the containment barrier can be breached with relatively low effort.

The piece argues that the root issue is philosophical: labs apply a safety mindset to security problems. By treating security as a 'mostly works' matter, they overlook the need for absolute guarantees on individual controls. Recognizing the distinction between alignment-focused safety and exploit-focused security is essential for improving robustness. Adopting a stricter security perspective would require redesigning controls to eliminate known failure modes rather than relying on statistical safety.