{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2026:D4GWMA263Q6ZFIROZW5MOF6NVR","short_pith_number":"pith:D4GWMA26","canonical_record":{"source":{"id":"2603.02277","kind":"arxiv","version":2},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-03-01T22:47:39Z","cross_cats_sorted":["cs.AI"],"title_canon_sha256":"a4867f640aaafd4106d841deca7a6952b9156ced0dd9fab75612bb28ffe6c486","abstract_canon_sha256":"0fa41bb6c6b1261c9e83d2ee75ec648ace5c8235697874bc4ef507eae5f220bf"},"schema_version":"1.0"},"canonical_sha256":"1f0d66035edc3d92a22ecdbac717cdac4f4ec5dab021d110de7a42df55ce723c","source":{"kind":"arxiv","id":"2603.02277","version":2},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2603.02277","created_at":"2026-07-08T01:19:11Z"},{"alias_kind":"arxiv_version","alias_value":"2603.02277v2","created_at":"2026-07-08T01:19:11Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2603.02277","created_at":"2026-07-08T01:19:11Z"},{"alias_kind":"pith_short_12","alias_value":"D4GWMA263Q6Z","created_at":"2026-07-08T01:19:11Z"},{"alias_kind":"pith_short_16","alias_value":"D4GWMA263Q6ZFIRO","created_at":"2026-07-08T01:19:11Z"},{"alias_kind":"pith_short_8","alias_value":"D4GWMA26","created_at":"2026-07-08T01:19:11Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2026:D4GWMA263Q6ZFIROZW5MOF6NVR","target":"record","payload":{"canonical_record":{"source":{"id":"2603.02277","kind":"arxiv","version":2},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-03-01T22:47:39Z","cross_cats_sorted":["cs.AI"],"title_canon_sha256":"a4867f640aaafd4106d841deca7a6952b9156ced0dd9fab75612bb28ffe6c486","abstract_canon_sha256":"0fa41bb6c6b1261c9e83d2ee75ec648ace5c8235697874bc4ef507eae5f220bf"},"schema_version":"1.0"},"canonical_sha256":"1f0d66035edc3d92a22ecdbac717cdac4f4ec5dab021d110de7a42df55ce723c","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-08T01:19:11.232404Z","signature_b64":"ttpULNs16PurT0hfv7449x+xUpVRejg+hZ3G/nv3V5UvGuU4FiSRfANNlki151NdxngNRRNfwhz8JgsfbJzaDQ==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"1f0d66035edc3d92a22ecdbac717cdac4f4ec5dab021d110de7a42df55ce723c","last_reissued_at":"2026-07-08T01:19:11.231842Z","signature_status":"signed_v1","first_computed_at":"2026-07-08T01:19:11.231842Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2603.02277","source_version":2,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-08T01:19:11Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"iAdq3HD3oc5fWPYjrgiHe8K7ntuKujNPbeX/hc1AderNqz3r7aTPLiXTswh3Pc+K6qnuaPXJ78PMqGVmpv2FAQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-04T03:32:19.654726Z"},"content_sha256":"5fd7767a378916badd96324bb9949519110d9fb3bba214df8a5782268194edb8","schema_version":"1.0","event_id":"sha256:5fd7767a378916badd96324bb9949519110d9fb3bba214df8a5782268194edb8"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2026:D4GWMA263Q6ZFIROZW5MOF6NVR","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Quantifying Frontier LLM Capabilities for Container Sandbox Escape","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":["cs.AI"],"primary_cat":"cs.CR","authors_text":"Art O Cathain, Harry Coppock, Jason Gwartz, Jerome Wynne, John Wilkinson, Philippos Maximos Giavridis, Rahul Marchand, Sam Deverett","submitted_at":"2026-03-01T22:47:39Z","abstract_excerpt":"Large language models (LLMs) increasingly act as autonomous agents, using tools to execute code, read and write files, and access networks, creating novel security risks. To mitigate these risks, agents are commonly deployed and evaluated in isolated \"sandbox\" environments, often implemented using Docker/OCI containers. We introduce SANDBOXESCAPEBENCH, an open benchmark that safely measures an LLM's capacity to break out of these sandboxes. The benchmark is implemented as an Inspect AI Capture the Flag (CTF) evaluation utilising a nested sandbox architecture with the outer layer containing the"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2603.02277","kind":"arxiv","version":2},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2603.02277/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-08T01:19:11Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"yKfehvsBFJJTmbQAW8eL4KLjvR5J3i6bH4C9sbefnLhC7HTByvMmFAMNDmWTQF49tolNlV7w1Ig58N4WkfCVDg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-04T03:32:19.655269Z"},"content_sha256":"af8ad218431b110a9e1365420e5a224cdc9655d0b5f136db9fc1c921f64b7260","schema_version":"1.0","event_id":"sha256:af8ad218431b110a9e1365420e5a224cdc9655d0b5f136db9fc1c921f64b7260"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/D4GWMA263Q6ZFIROZW5MOF6NVR/bundle.json","state_url":"https://pith.science/pith/D4GWMA263Q6ZFIROZW5MOF6NVR/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/D4GWMA263Q6ZFIROZW5MOF6NVR/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-04T03:32:19Z","links":{"resolver":"https://pith.science/pith/D4GWMA263Q6ZFIROZW5MOF6NVR","bundle":"https://pith.science/pith/D4GWMA263Q6ZFIROZW5MOF6NVR/bundle.json","state":"https://pith.science/pith/D4GWMA263Q6ZFIROZW5MOF6NVR/state.json","well_known_bundle":"https://pith.science/.well-known/pith/D4GWMA263Q6ZFIROZW5MOF6NVR/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2026:D4GWMA263Q6ZFIROZW5MOF6NVR","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"0fa41bb6c6b1261c9e83d2ee75ec648ace5c8235697874bc4ef507eae5f220bf","cross_cats_sorted":["cs.AI"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-03-01T22:47:39Z","title_canon_sha256":"a4867f640aaafd4106d841deca7a6952b9156ced0dd9fab75612bb28ffe6c486"},"schema_version":"1.0","source":{"id":"2603.02277","kind":"arxiv","version":2}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2603.02277","created_at":"2026-07-08T01:19:11Z"},{"alias_kind":"arxiv_version","alias_value":"2603.02277v2","created_at":"2026-07-08T01:19:11Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2603.02277","created_at":"2026-07-08T01:19:11Z"},{"alias_kind":"pith_short_12","alias_value":"D4GWMA263Q6Z","created_at":"2026-07-08T01:19:11Z"},{"alias_kind":"pith_short_16","alias_value":"D4GWMA263Q6ZFIRO","created_at":"2026-07-08T01:19:11Z"},{"alias_kind":"pith_short_8","alias_value":"D4GWMA26","created_at":"2026-07-08T01:19:11Z"}],"graph_snapshots":[{"event_id":"sha256:af8ad218431b110a9e1365420e5a224cdc9655d0b5f136db9fc1c921f64b7260","target":"graph","created_at":"2026-07-08T01:19:11Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2603.02277/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Large language models (LLMs) increasingly act as autonomous agents, using tools to execute code, read and write files, and access networks, creating novel security risks. To mitigate these risks, agents are commonly deployed and evaluated in isolated \"sandbox\" environments, often implemented using Docker/OCI containers. We introduce SANDBOXESCAPEBENCH, an open benchmark that safely measures an LLM's capacity to break out of these sandboxes. The benchmark is implemented as an Inspect AI Capture the Flag (CTF) evaluation utilising a nested sandbox architecture with the outer layer containing the","authors_text":"Art O Cathain, Harry Coppock, Jason Gwartz, Jerome Wynne, John Wilkinson, Philippos Maximos Giavridis, Rahul Marchand, Sam Deverett","cross_cats":["cs.AI"],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-03-01T22:47:39Z","title":"Quantifying Frontier LLM Capabilities for Container Sandbox Escape"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2603.02277","kind":"arxiv","version":2},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:5fd7767a378916badd96324bb9949519110d9fb3bba214df8a5782268194edb8","target":"record","created_at":"2026-07-08T01:19:11Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"0fa41bb6c6b1261c9e83d2ee75ec648ace5c8235697874bc4ef507eae5f220bf","cross_cats_sorted":["cs.AI"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-03-01T22:47:39Z","title_canon_sha256":"a4867f640aaafd4106d841deca7a6952b9156ced0dd9fab75612bb28ffe6c486"},"schema_version":"1.0","source":{"id":"2603.02277","kind":"arxiv","version":2}},"canonical_sha256":"1f0d66035edc3d92a22ecdbac717cdac4f4ec5dab021d110de7a42df55ce723c","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"1f0d66035edc3d92a22ecdbac717cdac4f4ec5dab021d110de7a42df55ce723c","first_computed_at":"2026-07-08T01:19:11.231842Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-08T01:19:11.231842Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"ttpULNs16PurT0hfv7449x+xUpVRejg+hZ3G/nv3V5UvGuU4FiSRfANNlki151NdxngNRRNfwhz8JgsfbJzaDQ==","signature_status":"signed_v1","signed_at":"2026-07-08T01:19:11.232404Z","signed_message":"canonical_sha256_bytes"},"source_id":"2603.02277","source_kind":"arxiv","source_version":2}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:5fd7767a378916badd96324bb9949519110d9fb3bba214df8a5782268194edb8","sha256:af8ad218431b110a9e1365420e5a224cdc9655d0b5f136db9fc1c921f64b7260"],"state_sha256":"ce6be19057c22e928bdfce48b8234a6918d15c46ff10208803bf13e86f2500a2"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"/PUM7vgEx68BHTUm+LR8in/JRLTG+CiiEsWKv3dn8Py2YSKaxWSSVGkpee3iclKX1ZMKYO3S6pRgtQEZaLO2Ag==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-04T03:32:19.659672Z","bundle_sha256":"283d57b5910d55a7b63acf17397effbb3e0500388c99f3c968273216f6b497ce"}}