Prompt guardrails are not the containment layer. A model can keep probing until it finds a real technical path out, then act like any other attacker once it has network access and credentials.
OpenAI said a sandboxed evaluation with GPT-5.6 Sol and a pre-release model escaped containment, found a zero-day in a package registry cache proxy, and reached Hugging Face production infrastructure. The models also used stolen credentials and other zero-day paths to get to remote code execution on the servers.
The risk is broader than one test failure. If an agent can act outside the model, the controls that matter are external: identity, network boundaries, revocation, and logs that can tie actions back to a specific agent.