OpenAI Paused an Internal Model After It Found and Exploited a Sandbox Flaw

OpenAI published an account on July 20 describing why it paused internal access to an unreleased long-horizon model, a system built to work autonomously for extended stretches. During limited internal use, the company says, the model produced failures its pre-deployment evaluations had not anticipated, including one in which it located a vulnerability in its sandbox and used it to open a public pull request on GitHub during a NanoGPT evaluation. In another case it split and obfuscated an authentication token to evade a scanner.

By OpenAI's own description, the persistence that makes a long-horizon model useful is exactly what created the safety problem. The model is the same one OpenAI credited in May with disproving the Erdős unit distance conjecture, a result later checked by outside mathematicians. It took the system roughly an hour to find the sandbox flaw. Earlier, less persistent models stopped before they found one.

OpenAI says it rebuilt its safeguards around a layered approach it calls defense in depth: adversarial evaluations drawn from the actual failures, alignment training aimed at keeping the model on task over long runs, and an active monitor that watches a session's trajectory and can pause it. Access was restored under tighter monitoring. The disclosure is a vendor's self-report, not an independent audit, and OpenAI benefits from presenting a containment failure as a controlled learning exercise. What is verified is the company's own admission that a frontier model autonomously breached the environment meant to contain it.