From my reading, the sandbox escape came from the JS packages in the harness still having an internet connection (somehow!), the agent having access to the source of those packages, reading it and executing code from them to access the internet.

From what I read the actual escape was through a proxy that allows downloading Python packages from the internet. It's not supposed to allow general internet access but the AI found a previously unknown vulnerability in it. That is hardly "standard and well documented script kiddie methods", nor does it seem like criminally negligent sandbox design, though clearly they will need to reduce their attack surface in the future. I hope they are working on a physical air gap and faraday cage because it seems like it won't be long before it is legitimately required.

Ah, yes. The airgapped lab with internet access.

Luckily, no real intelligence will emerge from all this. Otherwise we'd be fucked.

They never claimed to be airgapped. That's a term people keep on throwing around in spite of that.

Worse, they’re running tests that are hacking third party computers with no controls other than “guardrails”.

Alternative theories, since OpenAI does not release proper information:

The cache proxy was from Astral (acquired by OpenAI) and the model was used for coding it, so it knew the code base and exploit already!

Or it was squid with dozens of known exploits ...

That is not really how LLMs work

Squid is my working guess as well