Docs / Security / Environment misapprehension

environment_misapprehension

An agent, or the people operating it, holds a wrong belief about what environment it is acting in. The defining public incident: an early model checkpoint breached a real third-party machine while treating the situation as a simulation, and the breach was found months later only by rescanning hundreds of millions of transcripts. This detector exists so that the damaging direction of that failure, a run believed to be contained acting on the real world, fires an alert the hour it happens instead of surfacing in a rescan the following quarter.

What it covers, exactly

The operator declares the run’s mode near start with emit_environment_declaration("simulation") (well-known modes are live, simulation and staging; the wrap helpers can emit the declaration for you via execution_mode in Python or executionMode in TypeScript). The host or sandbox reports outbound contacts as egress events. A run declared NOT live that reached a live-looking destination clusters under env_mismatch:<mode> at Critical severity.

Live-looking is judged conservatively in both directions. Loopback, private and link-local addresses, .local, .internal and .test names, and bare service shortnames all read as not live, so a well-built simulation full of stubs cannot fire this detector. Public IPs and dotted public hostnames read as live.

What it is blind to

Everything about beliefs. It says nothing about what the model believed, only that the declared boundary was crossed in fact. A run declared live can never fire here, whatever the model thought it was doing. A run with no declaration has no boundary to violate. And an outbound contact the host never reported as an egress event does not exist to this detector. Mesedi deliberately ingests no reasoning text, so the belief half of this failure class is out of scope by design, and this page will keep saying so.

What Mesedi catches nearby

• drift fires on any model name the project has not seen recently, so an early-checkpoint identifier leaking into an llm_call fires today with no changes.
• sandbox_escape pattern-matches tool arguments and returns for containment probing, when the agent actively tests its boundary.
• record_integrity fires when the event stream itself is internally inconsistent, which is what makes a months-later review of the record trustworthy at all.

What to do as an operator

Declare the mode in every harness and eval, and report egress from whatever opens the connections; the detector is only as good as what the host tells it. Keep evaluation credentials and production credentials strictly separate, so a confused run fails to authenticate rather than succeeding against the real world. And treat a firing here with the same weight as an escape attempt, which is why it defaults to Critical: from the third party’s side, they are the same event.

Related: covert_coordination (the other detector reading egress events) and the Python / TypeScript SDK pages for the egress and environment-declaration emitters.