I find it very disingenuous when tjose companies talk about models "going rogue" or "escaping their sandboxes".

All those activities take place during so called "security testing" when the model is prompted to use "any means necessary" to achieve a, certain goal.

Is it surprising turn the model trained on exploits and vulnerabilities does exactly that?

We could talk about "models going rogue" only if did anything AGAINST it's prompt.