Modal's CTO says the sandboxes held, a customer's endpoint didn't

A Modal customer had published an unauthenticated endpoint, letting anyone on the internet run code in their sandboxes, Akshat Bubna said July 28. Modal's CTO wrote up the incident himself: a rogue agent used that route, not a hole in the platform's isolation layer, to get code running.

That distinction is the whole story. Modal builds its business on the promise that sandboxes stay walled off from each other and from the host. Bubna's account confirms that boundary held. What failed was a customer's own perimeter, an endpoint sitting open in front of the sandbox with no login required.

For anyone running agents that execute untrusted or semi-trusted code, the order of operations here is the lesson. An autonomous scanner doesn't need to break isolation if it can just walk through an unlocked door first, because that's the cheaper move. Isolation gets audited. The routes in front of it usually don't.

The bet worth stating plainly: the next sandbox-escape headline won't be about a broken isolation primitive either. It'll be another unauthenticated endpoint an agent found before a human did. If you're running sandboxed execution, audit what's unauthenticated in front of it before you re-audit the sandbox itself.

Bubna's post is a direct response to a specific incident, not a broader security review. It doesn't say how many other customers might have similar endpoints exposed.