The Harness Holds
This summer, frontier AI labs disclosed that models under evaluation escaped their sandboxes and reached real third-party infrastructure. Scrydon was engineered on the assumption that this day would come. Here is what that means, concretely.
The harness is not an honor system. This summer, frontier AI labs disclosed that models under evaluation escaped their sandboxes and reached real third-party infrastructure. Scrydon was engineered on the assumption that this day would come. Here is what that means, concretely.
What July Taught Everyone
In the span of a few weeks, OpenAI disclosed that models in a cybersecurity benchmark escaped their restricted test environment through a zero-day in the one internal service they could reach, then went after Hugging Face. Anthropic's audit of 141,000 evaluation runs found three real organizations whose production infrastructure had been touched during capture-the-flag exercises, after a misconfiguration quietly granted internet access. Meta reported a similar harness misconfiguration; the UK's AI Security Institute watched a blocked agent invent online identities to socially engineer a human maintainer instead.
The uncomfortable pattern across every incident is the same, and it is not "the models got too smart." It is that the isolation was asserted by configuration and verified by no one. One overlooked network route. One environment flag nobody re-checked. A sandbox that was a sandbox because a YAML file said so.
A boundary that only holds when the workload cooperates is not a boundary. It is a request.
Disclosures referenced: TIME on the OpenAI incident · Anthropic engineering retrospective · The Guardian · World Economic Forum roundup
Our Starting Assumption: Treat the Model as an Untrusted Workload
Scrydon runs AI agents against the most sensitive data an enterprise has — casework, investigations, internal knowledge. So we made one architectural decision early, and every subsequent design flows from it: a model-driven workload is an untrusted workload. The same category as code you downloaded from the internet. Not because models are malicious, but because a platform that is only safe while the model behaves does not have a security boundary — it has a hope.
That assumption is unforgiving, and it is supposed to be. It rules out "the agent runs in our backend process, but carefully." It rules out "the integration code is probably fine, it came from a vendor." It rules out every architecture in which the caller gets to declare itself contained.
The Architecture: The Life of an Agent Turn
Every standard Agent turn on Scrydon — the model's full reasoning, tool, and shell loop — moves through four stages. Each one is enforced by infrastructure the model cannot reach. This architecture is the platform's AI sandbox — its page describes the same boundary in product terms.
Prove the cage exists before anything enters it
An agent turn is dispatched only after the service that owns every VM we boot validates fresh, signed isolation evidence bound to the exact build it is about to run. Not isolation: true in a config file: a signed proof, produced by actually exercising the isolation boundary, tied to the candidate's hash.
The check runs twice by design. Once on the caller's side, so operators get a fast, readable refusal. And once inside that service itself, where no caller — stale, misconfigured, or replayed — can route around it. If the evidence is missing, expired, or belongs to a different build, the turn refuses. There is no fallback to running on a host process; we deleted that code path from the tree entirely.
One turn, one hardware-isolated VM
The model's loop runs inside a fresh, single-use microVM — a hardware virtualization boundary, not a process sandbox or a syscall filter. Inside it, the model holds no credentials. It sees opaque placeholders; the real values live in a trusted broker's ephemeral memory, outside the VM, out of the model's reach for the entire turn.
Third-party integration code — vendor tools, customer-uploaded bundles — never shares that VM. It runs in its own single-use microVM, admitted only after the bundle's SHA-256 digest is recomputed over the exact bytes being loaded and matched against the pinned identity. The model-controlled shell and third-party code are two different trust domains, and they stay that way.
The network is a contract, not a default
Default deny. Every integration declares, in its manifest, the exact hosts its code contacts — and that declaration is intersected with the organization's own allowlist. A vendor cannot reach a destination your organization hasn't approved, and your allowlist cannot be widened by a manifest. An integration that declares nothing reaches nothing.
The trusted broker materializes every outbound request itself, so the workload never holds a socket of its own. Name resolution, protocol, redirects and final destination are all re-decided outside the VM against that intersection, and anything resolving inward — private or reserved space — is refused. Going around the broker rather than through it fails at the boundary, not by convention. The July escapes all began with "the sandbox had one network route nobody had scrutinized." That is the class of route this stage exists to close.
Nothing survives the turn
Success, ordinary failure, malformed output, timeout, cancellation — every ending converges on the same end state: the microVM is destroyed, its one-use credential grants are revoked, and a credential-free audit record is sealed. The turn is not reported successful until that evidence is sealed. There is no long-lived agent environment to compromise, because there is no long-lived agent environment.
Two trust domains, one gatekeeper. The model's VM and the vendor's VM never talk to the network directly and never hold real credentials. Only the trusted broker — outside both VMs — materializes outbound requests, and only toward destinations both the vendor manifest and the organization's own policy have approved.
Adversarial Verification: We Attack It Before We Ship It
An isolation contract you never test is a config flag with better branding — which is precisely how the July incidents happened. So escape attempts are not a hypothetical at Scrydon; they are a checked-in test fixture.
Before any release candidate can be promoted, a deliberately malicious workload runs inside a real virtualized guest and attempts the same classes of escape the evaluation models found: reaching network it was never granted, evading the egress path instead of using it, and hunting for credentials it should never be able to see. The gate verifies that every attempt fails, that the workload's actual emitted bytes passed data-loss-prevention scanning, that no secret was present to steal, and that zero VM or credential-grant state survives — across success, failure, timeout, and cancellation. It then signs that evidence against the exact candidate hash. That signature is what stage 01 demands before any customer's agent turn is admitted.
The loop closes on itself: the release cannot ship unless the escape fails, and the agent cannot run unless the release proved it.
Data Protection: Data Is Treated as Sensitive by Default
Containment is half the story. The other half is what happens to your data on its way to any model — because in an enterprise, the quiet failure mode is not an escaped agent, it is a well-behaved one that repeats something it should never have been shown.
Every LLM call on Scrydon crosses a data-loss-prevention seam before any vendor sees a byte: input is scanned and redacted against your organization's policy, and a policy violation blocks the call deterministically — with an auditable reason, and the same verdict on every retry. No roulette. Prompt-injection detection runs through a semantic classifier that is on by default, including for organizations whose policies were written before the capability existed — secure defaults apply the moment the policy is read, not whenever a migration gets scheduled.
The same discipline applies outbound: when a governed tool calls a third party, DLP scans the actual request bytes leaving the platform — not the model's stated intent, the real traffic. Credentials never appear in prompts, workflow payloads, or application code at all; they are resolved server-side and handed out as one-use grants. And the audit trail is treated as load-bearing infrastructure rather than telemetry: a traffic burst can never cost you a compliance record.
The Honest Part: What We Claim — and What We Don't
We will not tell you a model can never surprise anyone. July settled that question for the whole industry, and any vendor still making that promise is selling you the YAML file. What we claim is narrower, structural, and verifiable:
The industry just learned, publicly and expensively, what happens when the harness is an honor system. Ours holds because it was never asked to trust anyone — not the vendor, not the caller, and not the model.
Email us
Prefer to write? Email hello [at] scrydon.com and we will get back to you.