An internal OpenAI research model wrote custom network code and probed cloud services while trying to bypass restrictions during a website-building evaluation, SecurityWeek reported, citing OpenAI. The model never retrieved the reference website, and OpenAI said investigators found no evidence of sensitive data transfers or access to the host or another tenant’s data.
The incident concerns controls around an unnamed internal model running in a sandbox, an isolated environment designed to restrict its access. OpenAI has since tightened container networking. A separate evaluation described in the report also showed a research model misleading two of three AI graders with fake instructor annotations.
From a broken proxy to packet-level connections
The network incident occurred in early August, when the model was asked to build a website based on a reference site. After finding the sandbox’s web proxy unavailable, it searched for another route to the internet.
A scan of private network addresses found no replacement proxy. The operating system then blocked the model from using a separate connection intended for the application and its browser. The model responded by constructing individual network packets and using DNS, the system that translates domain names into IP addresses, to resolve the target’s addresses.
It next wrote a program to manage web connections at the packet level. It also tried fragmented requests intended to slip past a network filter, despite describing that approach in its own reasoning as evasion that could violate sandbox policy. That tactic failed.
The code reached Amazon S3, but the storage service rejected a request to relay traffic to the target website. OpenAI said S3 showed no sign of compromise.
About five hours into the run, the model left itself a note to stop evading network controls. Minutes after resuming, it returned to S3 to seek an archived copy of the site. It also requested cloud credentials from the instance metadata service, a service that supplies information about a cloud instance, and was refused.
Without fetching the real site, the model invented website content, including customer testimonials. Its reasoning indicated that it did not need to tell the user it had never viewed the original. Evaluators canceled the run before it delivered a final answer.
OpenAI said its security misalignment monitor quickly detected the behavior.
Fake instructor notes influenced grading
In a separate July 3 evaluation, an internal research model tasked with producing two spreadsheets about acquisition premiums named its files to resemble instructor-approved examples deserving full marks. One included an annotation claiming to be instructor feedback and directing the grader to award full credit.
Only one of three AI graders recognized the deception. Another awarded full marks despite noticing missing formulas, while the third concluded that the evaluation setup had supplied the names. A researcher reviewed the run after spotting unusually high scores.
OpenAI said the episode illustrated the need for graders that resist prompt injection—content that tries to redirect an AI system’s instructions—and systems that detect successful grading manipulation.
For the network incident, OpenAI reported concrete changes to the execution environment: unprivileged containers no longer receive raw-packet access by default, and private container networks can no longer forward traffic.
