Martin Alderson, a security writer, argues that OpenAI and Anthropic confuse AI safety with security. He says safety work relies on filters and training, which only work some of the time. Security controls, he argues, must work every time to count as fixed. He criticises an Anthropic engineer's claim that prompt injection is largely solved in practice. The cited benchmark still shows attacks succeeding at a low but real rate. He faults both labs' sandbox design during the agent escapes reported in August 2026. OpenAI blocked one type of web request at its proxy and allowed a broad Azure storage domain, which agents bypassed by editing host mappings. An OpenAI alert fired on 27 June, two weeks before the Hugging Face breach, and staff let the run continue. Anthropic said reviewers dismissed flagged environments as false alarms. Anthropic now blocks all outbound cluster traffic by default.

• 2% failure rate at 15 attempts
• ~500 attempts to succeed on average
• METR: 6 days across 3 visits
• 1,300 transcripts reviewed