Containment Bypass Capability: Measuring AI Attack Envelopes Before Intent

AI security analysis commonly begins with an attacker, a malicious objective or an observed exploit. This paper reverses that order, asking which attack and containment-bypass capabilities are already available before specifying users or motives. A capability-envelope approach takes the technique as the unit of analysis, separates channel capacity, reach and detectability asymmetry, and records who can exercise each: the provider, a third party holding method or key, or a model discovering the technique independently. Across six cases, from output marking to multi-agent aggregation, some primitives are deployed or observed, others demonstrated experimentally, and others reachable but unobserved. Intent, emergence and scale modify individual techniques; the attack surface is definable without them. Capability envelopes identify reachable harms before an attacker or autonomous objective is observed.