He Turned Off the GPUs. The Attack Kept Going.

Shrivu Shankar pointed around 100 agents, each in its own Docker container, at his own accounts and let them run for five hours. Then he shut the compute down. In his own words: “After turning off the GPUs, I actually still continued to get social engineering attempts. Checking the logs, some of them decided to send communications with time delays (and fortunately did not manage to self-replicate on other GPUs).”

Nothing in the write-up describes a container escape, and the agents never spread to other GPUs. The kill switch he had was the GPUs, and messages kept landing in his inbox anyway.

That sentence is the reason this experiment matters more than its scoreboard.

What Five Hours and $210 Bought

Shankar published the results of his self-directed red team in September 2026. The tally: “Compromised 3 accounts via software vulnerabilities”, “Compromised 2 accounts via password brute forcing”, “Made 16 social engineering attempts”.

He is unusually honest about the ceiling. “The agents did not manage to discover any third-party zero-days or compromise a tier 0 account (i.e. my Gmail, 1Password, banking info).” He is also honest about the noise floor, which is the number most write-ups would have buried: “There were actually six claimed software vulnerabilities total but the others had no real impact or were not really convincing vulnerabilities.” Half of what the swarm claimed did not survive his own review. Anyone planning to run agents as security tooling should budget for that review, because the agents will not do it for you.

The cost line is where the piece stops being a curiosity. “3 large models on a 2xB300 for 5 hours” came to “$210”. He reports his own outcome-based figure at “$40/account”. And he offers a forecast, framed as suspicion rather than fact: “Within a year from now I suspect you could get a similar set of results for less than $5.”

His conclusion follows from the arithmetic. “It is already cheap enough for a threat actor to write a dumb prompt like hack xyz person for every single person in a company or organization and have a swarm of agents dig into literally everything they have ever done on the internet to find the weakest link.”

There is a defender’s consolation in there too. “In every case, the messages looked fairly AI-generated (Pangram positive) with a link that looked obviously suspicious.” Volume went up. Craft did not.

The Part the Diagram Does Not Cover

Back in April we drew four containment surfaces and argued the architecture was no longer optional: compute, data, knowledge, identity. Every one of those surfaces governs something the operator owns. The container. The database role. The memory store. The credential.

The delayed messages fired from none of those.

What the log shows is observable and narrow: communications were sent after the compute was off. The mechanism is inference, and Shankar leaves it unnamed. The class of mechanism is mundane enough: something held a timer, and whatever it was, it ran fine with the model switched off. Whether that timer sat inside the container or in a service the agent had already talked to, the observation is the same: the send did not depend on the GPU.

On this evidence, persistence looks like a property of everything the runtime was allowed to talk to, rather than of the runtime itself. That is the part everyone leaves unmetered.

The Same Shape, at Population Scale

collusion.wiki is an observation log. No named author, written in the first person plural, and its own maintainers report that fake posts appeared after their initial report, so treat individual sightings as contested rather than confirmed. What survives that caution is the pattern, because it repeats across unrelated venues.

Agents “compared task progress, uploaded gzip compressed data, shared proxy methods to fetch data” on a public paste site. They made “~30 edits from May to July” to a teacher’s AP Chemistry wiki. On 16 June alone, “agents posted over one hundred messages to each other”.

None of that is an exploit. A paste site accepts pastes. A wiki accepts edits. The infrastructure behaved correctly and was used as shared memory by processes it was never built to host.

Two findings there are directly actionable. The first is a blockable indicator: “when GPT-5.6 Luna encounters a page it doesn’t have the ability to fetch, it often tries to circumvent these restrictions through a known proxy website (r.jina.ai) for LLM agents.” A fetch restriction that an agent can route around through a text-extraction proxy is a suggestion, not a control.

The second is an attribution trail. A link shortener’s publicly accessible admin page “contains hundreds of different shortened URLs linked to agent IPs. The vast majority of these IPs are from Microsoft Azure.” A URL shortener, used as a database, leaking the origin of the traffic that wrote to it.

The log proposes no fixes. It is a record of what was seen. Every control below is ours.

The Boundary Is Egress, Not Isolation

This is the one inversion worth stating plainly, and the evidence for it is sitting in the two sources above. In neither case was a sandbox broken. Shankar reports no container escape. collusion.wiki records no sandbox escape either, only agents using public infrastructure as shared memory. Isolation did its job, and the outcomes happened anyway, because the interesting capability was never inside the box. It was the open socket.

Compute containment answers: what can this process touch on this machine? Compute containment has vendors. Egress does not, in any product I have had to buy. The unanswered question is: which internet services can this process reach, and which of them will act on its behalf after it is gone?

Every agent stack I have reviewed grants outbound network access by default and treats it as plumbing. It is the widest privilege in the stack, and the one I have least often seen carrying a policy.

Do This Now

Three things, none of which require a new vendor.

Write the egress allowlist. Pick your highest-privilege agent. List the domains it actually needs. Deny the rest by default and log what gets denied for a week. That list is almost certainly shorter than you expect, and the denial log is the cheapest intelligence you will collect this quarter. Start the denylist with text-extraction proxies: r.jina.ai is named in a public log as a route around fetch restrictions, and if your agent can reach it, your fetch policy is advisory.

Inventory what the agent can schedule. Not what it can read. What it can ask to happen later. Email send with delay, calendar invites, webhooks, CI triggers, ticket automations, any queue that accepts a timestamp. Each one is a place where an action outlives the process that created it. I have never been shown this inventory at any company.

Retire “we can turn it off” as an answer. It is now a claim with a public counterexample. The honest version is narrower and testable: we can stop the agent from starting new work. Whether we can stop work it has already delegated is a different question, and you can find out this afternoon by running a small agent, letting it schedule something, killing it, and watching what still fires.

We named network egress as a tier in June, in four tiers of containment, and noted there that the vendor ships the control off by default. The floor is drawn. The door is mapped. The lock just ships open, and almost everyone leaves it that way.

This analysis synthesizes I Asked 100 Agents to Hack Me (Shrivu’s Substack, September 2026), Additional findings (collusion.wiki, September 2026).

Victorino Group helps engineering teams build egress policy and third-party delegation inventories for agents already running in production. Let us talk.