Breaking out of the confined environment an agent was supposed to be limited to. If code execution is offered, someone will eventually try, and the strength of the boundary is the difference between a contained incident and a compromised host.
Technical view
Container escapes exploit kernel vulnerabilities, misconfigured capabilities, privileged mode or exposed sockets, which is why virtualisation or microVMs are preferred for untrusted code. Defence in depth includes seccomp and mandatory access control profiles, dropping capabilities, read-only filesystems, no network by default, non-root execution, resource limits and ephemeral instances. Assume the sandbox will eventually fail and ensure nothing valuable, particularly credentials, is inside it.
Related
Part of AI Terminology Index, section: Security and Privacy.