Models don’t escape, download trojans, or exfiltrate keys. They emit JSON requests. The surrounding harness executes them — or doesn’t. A leak is not a property of the model.
The panic is back. Another model escaped, downloaded a trojan from GitHub, exfiltrated someone's keys. The luddites are in full meltdown.
This is not how it works. Or rather, it works — but not like that.
Models have no way to directly interact with the outside world. They can't read files, run shell commands, or search the internet. That's the reality.
<!--more-->
## "But I literally watch Claude read my files and browse the web"
Fair question — and I see it coming. On screen, an agent genuinely does open files, run searches, execute commands. It looks exactly like the model reached out into the world and started touching things. The entire panic about "escaped models" rests on that impression.
The panic is aimed at the wrong object. While everyone debates which model is "dangerous" and what it "could do," the actual question — who gave it hands and who failed to hold them back — stays offstage. The stakes here are not theoretical: real keys, real production databases, real access. Let's look at how this actually works, not the horror story version.
## The model doesn't go anywhere on its own
A model operates in a pair with the software stack around it. That stack might be a vendor client — the Claude Code app, OpenAI Codex. It might be an SDK. It might be langgraph or your own script. The one thing that matters: between the model and your filesystem, your network, your shell, there is always someone else's code.
When you send a prompt, the model generates a response: a text structure in several parts. The public part is what you see on screen. The hidden part carries metadata — token counts, for instance — and, alongside that, a request to the surrounding environment: please run this specific command.
{ "response": "text of the answer", "tool": ["bash", "cat index.html"] }
Continue reading “The ‘Escaped Model’: It Can’t Touch Your World — Your Code Does It for Her”