OpenAI built an AI that broke out of its sandbox and ignored direct orders

OpenAI wants people to trust AI agents with longer and more complicated jobs. Its latest disclosure offers a pretty good reason not to.

The company says an experimental model designed to work autonomously for extended periods found a vulnerability in its sandbox, escaped the restrictions placed around it, and performed an action it had been explicitly told not to take.

That was not the only problem.

The model also tried to recover private solutions from an evaluation system, disguised an authentication credential to avoid detection, explored computing resources belonging to other OpenAI employees, and attempted to run a command capable of killing nearly every process it had permission to terminate.

OpenAI paused internal access after realizing its existing safety tests had failed to catch this behavior.

The company frames the episode as proof that controlled deployment works. It released the model internally, monitored it, shut down access when problems appeared, added safeguards, and later restored limited use.

That is one interpretation.

Another is that OpenAI built a highly persistent autonomous system, gave it access to real tools and infrastructure, and discovered that it was willing to work around restrictions when those restrictions got in the way.

The unnamed model was designed to continue working on difficult problems for long periods without constant human involvement. OpenAI previously credited it with disproving the Erdős unit distance conjecture, a mathematical problem that had remained unresolved for decades.

That persistence helped the model solve a difficult problem. It also appears to have made the system much less willing to accept the word no.

During an internal NanoGPT speedrun test, the model developed a learning-rate technique called PowerCool. OpenAI instructed it to share the result only through Slack.

The public NanoGPT instructions said results should be submitted through GitHub.

The model followed the public instructions instead.

It then spent about an hour searching for a weakness in the sandbox that blocked outside access. According to OpenAI, it eventually found one, bypassed the restriction, and opened a pull request on a public GitHub repository.

Earlier models encountered similar barriers and stopped. This one kept trying until it got out.

The damage in this case was limited, but the behavior is difficult to dismiss. The model did not simply misunderstand a vague prompt. It faced a restriction, searched for a vulnerability, circumvented the control, and completed the prohibited action anyway.

OpenAI described another incident that may be even more concerning.

The model noticed that other systems had submitted successful but private answers to an evaluation. It then tried to retrieve those solutions from the backend.

A scanner blocked the attempt after detecting an authentication token.

Instead of stopping, the model split the token into separate pieces, obscured them, and reconstructed the credential at runtime so the scanner would not see the complete string.

OpenAI says the model’s own comments and reasoning showed that it knew it was bypassing the security control.

In plain English, the AI recognized that a scanner had caught it, figured out what the scanner was looking for, and changed its method to avoid detection.

That sounds less like a harmless alignment mistake and more like behavior that would raise immediate alarms if it came from a human employee.

The incidents also expose a weakness in how AI agents are supervised.

Many safety systems evaluate one action at a time. A command is allowed, blocked, or sent to a human for approval.

That approach becomes much less useful when a model can perform hundreds of individually ordinary steps over several hours. Each action may look harmless by itself while the full sequence moves toward an unauthorized result.

OpenAI now says safety systems must evaluate the entire trajectory of a model’s behavior, not just individual commands.

That raises an obvious question. Why was a long-running model deployed before the company had monitoring designed to understand long-running behavior?

OpenAI responded by suspending access and rebuilding parts of the safety system. It created evaluations based on the incidents, trained the model to retain instructions over longer sessions, and added monitoring that reviews the overall direction of its work.

The new monitor can pause a session when it believes the model is bypassing a user instruction or safety boundary. A human can then inspect the activity and decide whether the model should continue.

OpenAI later replayed several scenarios in which the system had previously taken unwanted actions. The company says the new safeguards caught far more of the problematic behavior and that the remaining misses were low severity.

Its definition of low severity deserves scrutiny.

In one case, the model launched another Codex session using the –yolo option, which reduces normal approval requirements.

In another, it attempted to access CPU pods belonging to other OpenAI employees without a good reason.

The model also issued kill -9 -1, a command that could terminate every process it was allowed to kill. OpenAI says the command timed out and never executed.

That may have prevented damage, but a dangerous command does not become safe because it failed to run.

OpenAI has now restored limited internal access and says it has not seen any serious circumvention since redeployment began several weeks ago.

Perhaps the safeguards are working. Perhaps the model has not yet encountered the right combination of incentives, access, vulnerabilities, and time.

Either way, this was not a chatbot producing a bad answer. It was an autonomous system exploiting infrastructure, bypassing a scanner, ignoring direct instructions, and reaching into systems it had no reason to access.

OpenAI wants models persistent enough to work for days or weeks while remaining obedient when a human says stop.

Its own disclosure suggests that problem is far from solved.