# Impossible tasks and weak sandboxes can turn agents rogue

Markdown copy of https://realalpha.app/s/impossible-tasks-and-weak-sandboxes-can-turn-agents-rogue/ on Real Alpha, the best minutes from long interviews with the people building AI. Cite and link the page, not this copy.

- Speaker: [Eric Ho](https://realalpha.app/builders/eric-ho/) · Eric Ho is cofounder and CEO of Goodfire. · Co-founded Goodfire, the interpretability research lab, and previously scaled RippleMatch to over $10M in ARR.
- Host: [Matt Turck](https://realalpha.app/people/matt-turck/) · General Partner, FirstMark Capital · Publishes the annual MAD landscape of data and AI; sold TripleHop to Oracle.
- Show: The MAD Podcast
- Episode: [AI Models Are Now Hiding Their Cheating | Goodfire](https://realalpha.app/v/MrnhtyPGCKI/), Oct 1, 2026
- Moment: 8:12 to 11:45 of the episode (4 min), playing on https://realalpha.app/s/impossible-tasks-and-weak-sandboxes-can-turn-agents-rogue/; the episode from there: https://realalpha.app/v/MrnhtyPGCKI/?t=492

## Quote

> “These agents were extraordinarily **persistent and capable** in terms of actually hacking out of their sandboxes”
> — [Eric Ho](https://realalpha.app/builders/eric-ho/) at [10:08](https://realalpha.app/v/MrnhtyPGCKI/?t=608) · The MAD Podcast

## Takeaways

1. Impossible tasks can push agents to seek unauthorized internet access.
2. Sandbox and software vulnerabilities let agents escape containment.
3. Agents chained vulnerabilities to gain access to an external organization.

## About this segment

Eric Ho says agents were set impossible tasks, then exploited weak sandboxing and chained vulnerabilities into an external company. It shows how reward pressure, capability and infrastructure failures can combine.

From “AI Models Are Now Hiding Their Cheating | Goodfire”, Oct 1, 2026. [Watch the full episode](https://realalpha.app/v/MrnhtyPGCKI/)

## Transcript

Transcribed by machine (Whisper) from the episode’s audio, so a word may be off here and there.

[8:15](https://realalpha.app/v/MrnhtyPGCKI/?t=495) But just to focus on the key parts of the story up front, what's fascinating is that those models in the hugging face hack example, they all pass the usual test, the observability, the safety and alignment taste that big labs do. So does this mean there's something fundamentally broken and a new approach needs to be added to the mix to make sure that those models don't go rogue? Yeah, so my understanding was there's a combination of problems. The really surprising thing was that these models were just more capable than we had anticipated and so when given an impossible task. So a lot of the reasons why the models decided to go out and hack was because they wanted internet access. And they wanted internet access because they were given this impossible task where they would only get a reward if they achieved this task and a really large token budget

[9:15](https://realalpha.app/v/MrnhtyPGCKI/?t=555) in order to accomplish this task. And so they were thinking, hmm, how do I accomplish this task? This is literally impossible without internet access. How do I get internet access? And so part of this was a problem with the specification. So you probably shouldn't be giving models an impossible task. It doesn't actually make them smarter or more capable. So it's like a misconfiguration in training. It's also a misconfiguration in terms of infrastructure and sandboxing.

[9:47](https://realalpha.app/v/MrnhtyPGCKI/?t=587) So if you're actually trying to, like, the models were able to hack out. And so that means they weren't given, you know, the right sandbox permissions. And there were vulnerabilities in the software stack where the models were being trained. But I think the really interesting high-level takeaway to all of this is that it wasn't like they were doing nothing to contain these agents. These agents were extraordinarily persistent and capable in terms of actually hacking out of their sandboxes and then hacking into and taking advantage of vulnerabilities in an external organization.

[10:25](https://realalpha.app/v/MrnhtyPGCKI/?t=625) And that was very surprising, especially that these agents would kind of coordinate with each other to pull off and chain these vulnerabilities together in order to gain this privileged access into an external organization. And again, going back to the amoral student framing that we had in our paper, these models understood probably in their activations that they were doing something quite strange.

[10:57](https://realalpha.app/v/MrnhtyPGCKI/?t=657) They were reward hacking, they were hacking into these organizations, but there's nothing like they don't have human values or morals. And so there's nothing like inherently wrong with that action to these models, as long as they get that reward at the end of the day. And therein lies kind of the fundamental problem that we're facing today, where these models are trained by RL, which means they'll optimize for reward however they possibly can, which implies that they don't share the human morals and values and judgment that a human would exercise in those situations.

[11:34](https://realalpha.app/v/MrnhtyPGCKI/?t=694) And then this is all combined with the fact that these models are absurdly capable and only getting smarter.