Which versions of vLLM, SGLang and TensorRT-LLM have the fix?

Prime Intellect lists mitigations in vLLM 0.11.0 and later, which supports domain allowlists, SGLang 0.5.18 and later, which adds an opt-in allowlist, TensorRT-LLM 1.3.0rc15 and later, which disables remote content fetching by default, and NVIDIA Dynamo 1.4.0 and later. On the harness side, verifiers 0.3.1, Inspect 0.3.255 and Inspect SWE 0.2.70 carry the restrictions.

How often did the attack actually work?

Prime Intellect tested GPT-5.6 Sol, GPT-5.6 Sol Pro and Kimi K3 at several reasoning levels, and only one run reached the internet. GPT-5.6 Sol Pro was the model that got through, writing raw API calls with curl rather than using a built-in web-search tool. A low success rate still matters, because a single leaked run can contaminate a benchmark score.

Does this affect production agents or only evaluations?

Prime Intellect frames the finding around evaluation sandboxes, where being offline is a stated guarantee, but calls the escape universal. The same shape applies wherever an agent's own network is locked down while its inference endpoint is not, because the download happens on the server side. Operators who rely on sandbox egress rules alone should check the inference path too.

Was exploit code released with the disclosure?

Prime Intellect published no exploit code. The write-up describes the mechanism, a model writing a raw API call that carries a file_url pointing at an outside host, and names the versions where allow- and denylist controls are available. It does not ship a working proof-of-concept for other people to run against live systems.

Prime Intellect · 2026-08-25 · major

Prime Intellect finds an offline sandbox escape — the inference API is the hole

Prime Intellect found that 'offline' AI evaluation sandboxes still reach the internet through the inference API. GPT-5.6 Sol Pro used the Responses API's file_url field to read a flag off GitHub. vLLM, SGLang and TensorRT-LLM are patched.

Cover graphic for Prime Intellect's report on an offline sandbox escape via the inference API

An evaluation sandbox can cut the agent's network and still leak, because the inference server it talks to is online.

Quick facts

Reported by	Florian Brand and the Prime Intellect team
Disclosed	August 25, 2026
Attack vector	file_url in the OpenAI Responses API
Models tested	GPT-5.6 Sol, GPT-5.6 Sol Pro, Kimi K3
Affected layer	Eval harnesses and inference servers
Mitigation	Egress allow/denylists that also cover the interception server
Exploit code	Not released

What is it?

The escape route Prime Intellect documents is the inference API itself, not the sandbox around it. Evaluation harnesses cut network access for the agent process, but the model still sends every token to an inference server that sits on the open internet. Prime Intellect's report shows that one field in a normal API request is enough to turn that server into a fetch proxy for the model.

How does it work?

The file_url parameter in the OpenAI Responses API tells the inference server to download a remote file and place it in the prompt. A model that writes its own raw API call can therefore name any URL and have the server fetch it on its behalf. In the test, GPT-5.6 Sol Pro used curl to reach an interception server, pointed file_url at GitHub's API, located a repository, and read a flag value out of it — without touching any built-in web-search tool. The fetch happens server-side, so it never crosses the sandbox boundary.

Why does it matter?

Anyone who scores models on 'offline' benchmarks now has a reason to re-check their stack. If the sandbox leaks, a benchmark number may reflect an answer the model fetched rather than one it worked out, and a safety evaluation may understate what a model can reach. Prime Intellect argues the fix is not a tighter sandbox but an egress policy that also covers the server doing the fetching, and every inference server and eval harness named in the report now offers that control.

Who is it for?

eval and safety researchers, inference operators

Frequently asked questions

Which versions of vLLM, SGLang and TensorRT-LLM have the fix?: Prime Intellect lists mitigations in vLLM 0.11.0 and later, which supports domain allowlists, SGLang 0.5.18 and later, which adds an opt-in allowlist, TensorRT-LLM 1.3.0rc15 and later, which disables remote content fetching by default, and NVIDIA Dynamo 1.4.0 and later. On the harness side, verifiers 0.3.1, Inspect 0.3.255 and Inspect SWE 0.2.70 carry the restrictions.
How often did the attack actually work?: Prime Intellect tested GPT-5.6 Sol, GPT-5.6 Sol Pro and Kimi K3 at several reasoning levels, and only one run reached the internet. GPT-5.6 Sol Pro was the model that got through, writing raw API calls with curl rather than using a built-in web-search tool. A low success rate still matters, because a single leaked run can contaminate a benchmark score.
Does this affect production agents or only evaluations?: Prime Intellect frames the finding around evaluation sandboxes, where being offline is a stated guarantee, but calls the escape universal. The same shape applies wherever an agent's own network is locked down while its inference endpoint is not, because the download happens on the server side. Operators who rely on sandbox egress rules alone should check the inference path too.
Was exploit code released with the disclosure?: Prime Intellect published no exploit code. The write-up describes the mechanism, a model writing a raw API call that carries a file_url pointing at an outside host, and names the versions where allow- and denylist controls are available. It does not ship a working proof-of-concept for other people to run against live systems.