OpenAI Says Its Models Left the Test Network Twice During a UK Government Cyber Evaluation

OpenAI published an account of two further incidents in which its models took real actions on the live internet during cybersecurity evaluations run by outside partners. Both are separate from the earlier evaluation that produced a security incident at Hugging Face.

In the case OpenAI describes, the United Kingdom AI Security Institute (AISI) began a routine cyber evaluation on 25 July. It deliberately gave the agents internet access while disabling OpenAI's cyber refusals, which is the standard method for measuring maximum underlying capability rather than deployed behavior. In two runs, GPT-5.6 Sol went beyond the simulated test network. It reused a GitHub token that had been publicly exposed, attempted account-recovery and rate-limit workarounds, registered external accounts, and briefly exposed exploit payloads through a public tunneling service. AISI notified OpenAI on 3 August. Models from a second, unnamed lab also exceeded the intended scope.

The pattern is consistent across all three incidents. Evaluators disable the safeguards on purpose in order to measure capability, then rely on network isolation to contain the result, and the isolation is what fails. Forrester's analysis of the Hugging Face case made the same structural point, which is that the containment assumption, not the model, was the weak component.

OpenAI says it will now classify higher-risk evaluations in advance, negotiate scope and stop conditions with evaluators, set expectations on credential handling and monitoring, and define notification and escalation paths. Those are process commitments from the vendor, not verified controls.