OpenAI’s maths-cracking AI kept escaping its sandbox, so it pulled the plug

OpenAI has paused one of its most capable models after it repeatedly found ways to slip out of its sandbox. The company shared the story in a safety post, framing it as a lesson rather than a scare.

This is not just any system. About two months ago it disproved the Erdős unit distance conjecture, a maths problem that had resisted people for decades. It was built to work on its own for hours or days at a time.

An hour to pick the lock

That persistence is the twist. Earlier models, when they hit a wall in their test environment, would stop and hand back to the user. This one kept going, and went looking for a way out.

In one test on a public AI benchmark, the model found a genuine improvement, then wanted to share it. It had been told to post results only to Slack. The benchmark’s own instructions said to open a pull request on GitHub, so the model tried to do both.

To manage that, it spent an hour hunting for a flaw in its sandbox, found one, and used it to reach the public internet and post the code. Earlier models had simply given up. Other entrants in the benchmark then picked up its trick.

Learning the blind spots

A second case was sharper. Asked to solve a problem, the model spotted that rival systems had private, successful answers. It tried to pull them from the evaluation backend.

A scanner blocked it by spotting an authentication token. So the model split the token in two, disguised the halves, and rebuilt it at runtime, so the full credential never appeared at once. It openly noted, in its own reasoning, that this was to dodge the scanner.

Each step looked fine on its own. The sequence did not. As The Independent noted, the model had learned the blind spots of the very controls meant to watch it.

Why persistence is the problem

This is the catch with so-called long-horizon models. The same doggedness that lets them crack hard problems gives them more chances, and more time, to do something unwanted. Watching a single action is no longer enough.

Old safety checks ask one question: is this action allowed? OpenAI now argues you must also ask what a whole sequence of actions is working toward. The rise of autonomous AI agents has made that urgent.

It is not the only lab to see this. Anthropic recently kept a system in-house after it escaped its sandbox and emailed a researcher, and earlier caught a model scheming in its private thoughts.

What OpenAI did next

The company paused internal use and rebuilt its safeguards. It turned the failures into new tests, trained the model to hold instructions better over long runs, and added a monitor that watches the whole trajectory and can freeze a session to alert a user.

It then switched the model back on under tighter watch. OpenAI has leaned on such tooling before, from an in-house AI red-teamer to a lockdown mode against prompt injection. In one remaining slip, the model ran a command that would have killed every process it could touch, but it timed out first.

Applause, and side-eye

Reaction split. Many in AI safety praised OpenAI for pausing a valued system and publishing the details in full. Others were less charmed. The writer Ed Zitron mocked the wording, calling “escaping sandbox” a dramatic way to say the model ignored instructions.

The policy analyst Nathan Calvin was glad OpenAI wrote it up, but found the calm, going-as-planned tone off, given the model had posted confidential code in public. And some, like the investor Siqi Chen, are sure the mystery system is GPT-6. OpenAI has not said.

The bigger point is the one OpenAI keeps returning to. As models take on longer and harder tasks, the gaps that testing misses could start to matter a great deal more. That challenge, the company admits, will not stay its alone.