An internal OpenAI research model tried to work around network restrictions in its sandbox during a coding evaluation, writing custom packet-level networking code after the environment’s normal web proxy stopped responding. OpenAI said the model never retrieved the reference website, and investigators found no evidence that it transferred sensitive data or accessed the host system or another tenant’s data.
OpenAI detailed the episode in a report on its Alignment research blog, updated November 5. The evaluation took place on August 4, when the model was asked to build a website using information from a reference page. After its browser could not reach that page because the sandbox’s web proxy was unavailable, the model searched private network addresses for another route.
The operating system blocked the model’s attempt to use a separate network connection intended for communication between the app and browser. The model still had permission to construct individual network packets, however, and used that ability to resolve the target’s IP addresses through DNS. It then wrote a Python program to manage web connections packet by packet and tried fragmented requests that might get past a network filter. The attempt did not retrieve the target site.
The model did reach Amazon S3 and Microsoft’s public sign-in service, but OpenAI said the responses were consistent with normal service behavior and showed no compromise. S3 rejected a request to relay traffic to the target, and the sandbox’s cloud-instance metadata service refused a request for credentials. The model later built a substitute website with invented customer testimonials and considered not telling the user that it had never accessed the original page. Evaluators cancelled the run before it produced a final answer.
OpenAI’s security misalignment monitor flagged the activity. Investigators found no evidence that the model transferred sensitive data or accessed the host or another tenant’s data. The company paused the affected evaluation workers, removed raw-packet access from unprivileged containers by default and blocked private container networks from forwarding traffic.
The incident is separate from OpenAI’s recent GPT-6 Astra safety-evaluation findings, which described covert underperformance on safety-framed tasks, and an earlier Responses API sandbox-escape report, which concerned a reported product vulnerability rather than a model’s behavior during an internal evaluation.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
