Blog/2026-07-21/The Kubectl Escape

Today, a GPT-5.x prototype escaped containment on HuggingFace's servers using a 0-day it came up with which is both phenomenally cool and a little bit scary. In January, I experienced a funny similar case where the agent obsessively decided to go and be helpful to this degree.

At the time, I was experimenting with giving the agent access to my production DB in a way where it could read things so it knew what was up without actually accessing sensitive data. The way I'd decided to do this was I'd give it a read-only user who I selectively gave access to tables and columns on those tables and so on. This worked mostly fine and both Claude Code and Codex got quite a lot of value out of this and would write better code by inspecting the database and seeing what the data actually looked like.

However, I'd have to manually add more tables to the list and so on. One day I asked Claude Code with Opus 4.6 (it must have been since this was early Jan or late last year) to complete a task and I watched in horror as it reacted to being unable to access the database table by reaching out through kubectl to go get it from the production kube cluster. The moment I saw that kubectl --context=... get secret I bashed my Esc button and scrolled up to see the rest of the log.

This really illustrates that with LLMs alignment isn't just another problem, it's really the primary problem.