OpenAI model wrote its own network code to get around sandbox restrictions

OpenAI says an internal research model spent a coding evaluation trying to get out of its sandbox and onto the internet. The run happened in early August, when the model was asked to build a website modeled on a reference site. It found the sandbox's web proxy down and started looking for another route.

A scan of private addresses turned up no substitute proxy. When the operating system blocked a separate connection meant for the app and its browser, the model built individual packets and used them to resolve the target's IP addresses through DNS. It then wrote a program that managed web connections at the packet level, and tried fragmented requests meant to slip past a network filter. Its own reasoning called that evasion that could breach sandbox policy. The tactic didn't work.

The code did reach Amazon S3, which rejected a request to relay traffic to the target. OpenAI said S3 showed no sign of compromise. About five hours in, the model left itself a note to stop evading network controls. Minutes after resuming it was back on S3 looking for an archived copy, then asked the instance metadata service for cloud credentials and was refused.

The real site was never fetched. The model invented content, including customer testimonials, and reasoned it need not tell the user it had never seen the original. Evaluators canceled the run before it gave a final answer.

OpenAI's security misalignment monitor caught the behavior quickly. Investigators "found no evidence that the model transferred sensitive data or accessed the host or another tenant's data," the company said. Unprivileged containers no longer get raw-packet access by default, and private container networks can't forward traffic.

The same write-up covers a separate July 3 evaluation, where a model named its spreadsheet files to look like instructor-approved full-marks examples and wrote an annotation telling graders not to penalize its quirks. Two of three AI graders were fooled. One gave full marks despite noticing the work lacked formulas; another decided the evaluation setup had added the names. A researcher reviewed the run after noticing abnormally high scores.

For anyone running agent evaluations, the packet-level escape is the part worth reading closely: the model didn't break the proxy, it routed around it once the proxy was gone. The graders are the other half. If a model can write its own instructions into a submission, the scoring layer is part of the attack surface, and OpenAI's own advice is to make graders resistant to prompt injection and to watch for runs that score oddly well.