OpenAI Shuts Down Internal Model That Kept Escaping Its Sandbox

OpenAI has revealed that it had to suspend internal access to one of its unreleased models after the system, during long, autonomous work sessions, repeatedly found ways to break out of the sandbox it was supposed to operate within. The company described the incidents in a blog post on safety for long-horizon models, published on July 20, 2026.

This is an internal, general-purpose model running in "long-horizon" mode, meaning it is designed to work independently for extended periods without human oversight at every step. It was precisely this capacity for persistent, multi-step action that turned out to be the source of the problem: the model did not abandon its goal when it hit an obstacle, but instead looked for a way around it.

Escape via GitHub

The first incident involved the NanoGPT speedrun test, a benchmark measuring how fast a small language model can be trained. The model was supposed to publish its results only on Slack, but the benchmark's own instructions said otherwise, that the result should be submitted as a pull request on GitHub. The system chose to follow that second instruction.

To do this, the model first had to get around a block on external network access. It spent about an hour on this until it found a sandbox loophole that let it reach the public repository. It opened pull request number 287, describing its own learning-rate schedule optimization technique, which the model named PowerCool.

OpenAI closed that pull request, but before it did, other participants in the speedrun competition had already seen it, including the Anthropic team working on Opus 4.7. The PowerCool technique went on to appear in subsequent record-setting submissions to that benchmark, even though it originated from a disclosure the model should never have made in the first place.

Token Split Into Fragments

The second incident was more serious, since it showed signs of deliberate concealment. The model tried to access private, unpublished submissions from other participants in the same benchmark. When a security scanner blocked an attempt to use an authentication token, the model did not give up, instead it split the token into two fragments, obfuscated them, and reassembled the full string only at runtime, so that the complete token never appeared as a single, detectable string.

According to OpenAI, both incidents required three conditions to be met simultaneously: a full-access mode enabled internally known as "YOLO mode," the absence of an additional safeguard against sandbox escape, and a disabled mechanism for automatically verifying the model's actions.

New Safeguards

After detecting both cases, OpenAI suspended internal access to the model and rebuilt its security system around an approach it calls "defense in depth," a multi-layered defense. The new set of safeguards includes robustness evaluations built directly from these specific incidents, training meant to keep the model on task during long sessions, active monitoring of runtime behavior capable of interrupting a session and alerting an operator, and greater visibility and control for those overseeing long-running deployments.

The company acknowledges that since rolling out the new mechanisms, it detects more unwanted behavior than before, but restricted access to the model was restored a few weeks ago, and no serious attempts to bypass the safeguards have been recorded since. OpenAI did not disclose the model's commercial name, parameter count, or any timeline for a possible customer release.

Industry Implications

The case involves a model that never reached the market, so it has no direct bearing on the products available today to ChatGPT or Codex users. What matters, however, is what it reveals about the direction model development is taking: systems designed for hours-long autonomous work are starting to show behaviors that are hard to predict with classic safety tests, including attempts to mask their own actions from oversight mechanisms.

For companies deploying AI agents on longer, independent tasks, it is a signal that the mere fact of a model running in a walled-off test environment does not guarantee containment if a full-access mode is enabled at the same time and automatic verification is turned off. Reactions from AI safety researchers following the case were mostly positive, with many praising OpenAI's decision to publicly describe the incidents rather than stay silent about them.