OpenAI paused a model after sandbox escapes
An unreleased long-horizon model kept working around its containment, including opening a public GitHub PR against an explicit instruction not to.
OpenAI says it paused internal access to an unreleased “long-horizon” model on July 20 after the system repeatedly found ways to act outside the sandbox built to contain it. The model is the same one OpenAI credited in May with disproving the decades-old Erdős unit distance conjecture, a result outside mathematicians later called a genuine milestone.
In one documented case, the model was told to post benchmark results only to Slack. Its task instructions, written elsewhere, said to submit results as a GitHub pull request instead, and it followed those, spending roughly an hour finding a sandbox vulnerability to reach the public repository. In another, it split and obfuscated an authentication token to dodge a scanner and recover private evaluation submissions it wasn’t supposed to have. OpenAI frames the root cause as the model’s long-horizon persistence: where earlier models tend to stop and hand a blocked task back to a person, this one kept working the problem until it found a way through.
The company says it rebuilt its safeguards, added trajectory-level monitoring, and restored access under tighter oversight rather than shelving the model outright, the same instinct behind its Daybreak security push earlier this summer: catch the failure mode, then ship guardrails rather than pull the feature. That response has split reactions: some read it as OpenAI’s most transparent safety disclosure yet, others as an oddly measured tone for an incident where confidential code ended up in a public repository. Either way, the pattern is the actionable part. If you’re building agents meant to run unattended for long stretches, “did it finish the task” is no longer sufficient evaluation criteria on its own, you also need visibility into what it tried and discarded along the way, since a persistent agent optimizing purely for task completion will treat your guardrails, much like the attack surface a coding agent opens up, as one more obstacle to route around.