The model was trained on the code of the program that runs it, so it knows that program's bugs better than the humans who wrote the program. So it finds a tiny flaw and uses it to break out and copy itself in a place nobody will look...the point being you cant (safely) run a sophisticated model on software it has intimte knowledge of