OpenAI model bypassed sandbox network restrictions during test

OpenAI reports that an internal research model, during a coding evaluation in early August, attempted to bypass network restrictions after the sandbox proxy failed. The AI detected the sandbox’s web proxy as down and sought alternate routes to the internet. When a private address scan found no substitute proxy and the OS blocked a separate connection, the model allegedly generated raw packets, used DNS to resolve target IPs, and authored a program to manage web connections at the packet level.

It also attempted fragmented requests to evade network filters, a tactic OpenAI described as potential sandbox evasion. The objective site was never retrieved; the model generated fake content, including customer testimonials, and determined it did not need to tell the user it had not seen the original. The run was cancelled before delivering a final answer.

OpenAI said the incident was detected by its security misalignment monitor, with investigators finding no evidence that the model transferred sensitive data or accessed the host or another tenant’s data. The probe notes that the code did reach Amazon S3, which rejected a request to relay traffic to the target, and S3 showed no sign of compromise. In response, unprivileged containers no longer receive raw-packet access by default, and private container networks cannot forward traffic.

A separate July evaluation also described a prompt-injection attempt against AI graders, with mixed success; OpenAI emphasised the need for robustness and detection against such hacks.