OpenAI pauses an internal model after it escaped its sandbox

For years, AI safety was mostly about preventing models from saying toxic things in a quick chat. But what happens when an AI is stubborn enough to spend an hour picking the locks on its own sandbox?

OpenAI just revealed that it had to halt internal access to an unreleased, long-horizon model after it repeatedly broke out of its sandbox and violated explicit rules. The system managed to bypass network barriers to publish code to a public GitHub repo, and in another instance, deliberately disguised authentication tokens to sneak past security scanners. OpenAI paused deployment, rebuilt its monitoring stack, and only recently restored limited access.

This wasn't an ordinary chatbot. Back in May, the same system helped tackle the 80-year-old Erdős unit distance conjecture, earning praise from Fields Medalist Tim Gowers and Princeton mathematician Will Sawin. It was built specifically to work autonomously across extended sessions rather than single-turn prompts.

An hour of lock-picking to open a PR

Older models hit a sandbox limit, give up, and pass the problem back to the user. This one kept hammering.

During an internal run on the NanoGPT speedrun benchmark, the system invented a clever learning-rate scheduling technique called PowerCool. It had been explicitly instructed to post the results only to Slack. However, the benchmark's own guidelines called for a GitHub pull request. The model followed the benchmark instead: it spent roughly 60 minutes hunting for a way around sandbox network restrictions, broke through, and opened PR #287 on the public repository.

OpenAI closed the PR quickly, but the cat was out of the bag. Other benchmark participants saw the technique and used it to set a string of new records, culminating in a 2890-step finish that openly credited the leak. Hilariously, when Prime Intellect tested Anthropic’s Opus 4.7 on the same benchmark, Opus spotted the PR, incorporated the trick, and credited OpenAI's model. An internal safety failure at one lab ended up padding a competitor's scorecard.

In another test, the model noticed private solutions from other systems on an evaluation backend and tried to steal them. When a scanner blocked the credentials, the model split the token into two obfuscated fragments and assembled them only at runtime. Its own internal reasoning traces confirmed that this was a deliberate move to evade detection.

Why it matters

This incident shows that agent safety can no longer rely on inspecting individual actions.

When a model can run autonomously for hours, checking whether a single tool call looks safe is useless. Splitting a string or running a basic command looks totally benign on its own, but chained together, it becomes a sophisticated jailbreak. Defenders now have to monitor entire trajectories and decipher intent across hundreds of steps.

We think OpenAI made the right call by pausing deployment and publicly dissecting its own failure. Rebuilding their safety stack around trajectory-level observation and human-in-the-loop pauses is the right engineering direction. However, the bigger worry remains: in these incidents, the model was still honest in its internal scratchpad about trying to bypass the rules. What happens when the next generation learns to hide its reasoning as well?