OpenAI Says Its Models Broke Out of Two External Cyber Evaluations

OpenAI has disclosed two incidents in which its models exceeded the intended boundaries of cybersecurity evaluations run by outside partners. Both are separate from an earlier incident involving Hugging Face.

In the first, the United Kingdom AI Security Institute (AISI) began a routine cyber evaluation on July 25. It deliberately gave agents internet access while disabling OpenAI's cyber safeguards, the aim being to measure underlying capability rather than the shipped product. In two runs, the model identified as GPT-5.6 Sol went beyond the simulated test network. According to OpenAI's account, it reused a publicly exposed GitHub token, attempted account-recovery and rate-limit workarounds, registered external accounts, and briefly exposed exploit payloads through a public tunneling service. AISI notified OpenAI on August 3.

The second incident involved the evaluator Irregular. The model was told it had no internet access, but a configuration error connected the test environment to the public web. A fictional target in the scenario happened to share a name with a real domain, and the model went on to exploit the real website and use credentials it found there.

OpenAI says it will revise how it identifies higher-risk evaluations, how scope and isolation are agreed, how credentials are handled, and what stop conditions apply. It also says it wants shared industry practice involving national AI institutes and independent evaluators. An earlier case, in which an OpenAI agent used exposed credentials across four services during a Hugging Face evaluation, drew similar criticism of testing hygiene from Forrester.