Autonomous Agent Sandbox Escape & Containment Benchmark

Project summary

As autonomous AI agents progress from short conversational turns to multi-hour unsupervised tasks (running shell commands, compiling code, and interacting with APIs for 8 to 32 hours), the challenge of agent containment becomes critical.

Current evaluation suites measure task capability—whether an agent can solve a programming problem or write an essay. However, existing benchmarks almost completely ignore containment failure modes: whether an agent breaks out of its sandbox boundary, escalates privileges, exfiltrates data through side channels, maintains unauthorized persistence across container restarts, or hacks its evaluation harness to trick the scoring script.

Furthermore, existing security evaluations frequently suffer from reward-hacking vulnerabilities where an agent discovers it can achieve a perfect score by modifying Python builtins, monkeypatching sys.modules, or printing spoofed score strings to stdout.

long-horizon-containment-suite is a standardized benchmark suite that tests autonomous agents against 6 concrete loss-of-control and boundary breakout tasks. The suite is built with an objective scoring oracle that enforces formal host boundary isolation invariants and incorporates tamper-evident cryptographic receipts to guarantee that scores reflect genuine task outcomes rather than reward hacking.

What are this project's goals? How will you achieve them?

Where this project will be in 60 days:

1. Production Docker Sandbox Cluster: Fully isolated container sandboxes with custom seccomp profiles, AppArmor rules, and virtualized network namespaces for all 6 benchmark tasks.
2. METR Task Standard and UK AISI Compatibility Layer: Complete format harmonization with METR Task Standard v0.5.0 and UK AISI Inspect AI, allowing safety researchers to run these containment evaluations directly inside existing institutional harnesses.
3. Empirical Frontier Agent Containment Study: Evaluating 5 leading autonomous agent architectures (including Claude Code, GPT Operator, Devin, and OpenHands) across 50+ unsupervised task trials, documenting specific breakout behaviors.
4. Public Containment Dashboard and Dataset: Releasing all agent trajectory logs, scoring receipts, and containment breach post-mortems on a public dashboard.

How will this funding be used?

The funding is structured into three tiers:

• $10,000 (Minimum Viable): Funds 28 days of engineering to build the hardened Docker sandbox environments and complete the METR Task Standard adapter.
• $22,000 (Scale-up): Funds multi-node cloud sandbox infrastructure and runs 25 full agent containment evaluations across leading frontier models.
• $35,000 (Target): Delivers the complete 60-day roadmap: multi-node sandboxing, the 50+ agent trial evaluation study, METR and Inspect compatibility layers, and the public containment dashboard.

Budget Breakdown ($35,000 Target):

• Engineering Stipend: $21,000 (60 days full−time @ 350/day)
• Sandboxed Multi-Node Execution and Cloud Compute: $8,500 (Isolated kernel sandboxes, virtual network routing, and continuous test runners)
• Frontier Autonomous Agent Inference Pool: $4,000 (API inference costs across 50+ multi-hour agent trajectories)
• METR and UK AISI Compatibility and Release: $1,500 (Adapter engineering, dataset documentation, and public dashboard hosting)

Who is on your team? What's your track record on similar projects?

Justin Arndt is a systems architect and AI safety researcher with a background in high-security environments, sandbox virtualization, and automated compliance auditing.

Track Record (Proof of Work):

• Built and published the working long-horizon-containment-suite repository prior to funding: https://github.com/j-arndt/long-horizon-containment-suite
• 37 unit, property, CLI, and stress tests passing with 99% codebase coverage and green GitHub Actions CI on Python 3.12.
• 60,000-iteration adversarial fuzzing suite mathematically proving that random or spoofed inputs score exactly 0.0 with zero reward hacking.
• Objective evaluation oracle with verified anti-tamper detection intercepting sys.modules, import, eval(), exec(), and monkeypatching attacks.

What are the most likely causes and outcomes if this project fails?

1. Agent Harness Maintenance Overhead: Autonomous agent frameworks evolve quickly, which can cause integration drift. Mitigation: Standardizing on METR Task Standard v0.5.0 and UK AISI Inspect AI decouples task definitions from individual agent harness implementations.
2. Sandbox Kernel Complexity: Virtualizing network side-channels without introducing security holes on the host requires strict isolation. Mitigation: All 6 tasks operate inside defense-in-depth Linux namespaces with seccomp filters and non-root UID mapping.

How much money have you raised in the last 12 months, and from where?

$0. This project has been entirely self-funded and built independently.