Do interrupt your enemy when they are making a mistake

Maybe I am the idiot. Maybe this is the perfect moment for OpenAI to take a victory lap around Anthropic and their epic Fable Face Palm. Maybe they read the room and decided the right move is to announce that their system escaped its sandbox and oh btw check out this cool chart showing how sad Fable is! /highfive

Or this is going to backfire…

OpenAI and Hugging Face partner to address security incident during model evaluation

“address” as in we didn’t even bother setting up a sandbox. Because they didn’t. This is why they are not releasing hundreds of pages of notes and diagrams like they do for their rate cards. There was no sandbox. They are building a harness for a capture the flag exercise (something I happen to know quite a bit about).

From the Security incident disclosure — July 2026

The asymmetry problem

When we started the log analysis, we first used frontier models behind commercial APIs. This did not work: the analysis >requires submitting large volumes of real attack commands, exploit payloads, and C2 artifacts, and these requests were >blocked by the providers’ safety guardrails, which cannot distinguish an incident responder from an attacker. We ran the >forensic analysis instead on GLM 5.2, an open-weight model, on our own infrastructure. This had a second benefit: no >attacker data, and none of the credentials it referenced, left our environment.

I can’t stop laughing.

We already knew that ChatGPT Sol was very aggressive, especially when /plan is used to focus on a specific attack vector.

Alibaba wrote about a similar incident

When rolling out the instances for the trajectory, we encountered an unanticipated—and operationally consequential—class of unsafe behaviors that arose without any explicit instruction and, more troublingly, outside the bounds of the intended sandbox. Our first signal came not from training curves but from production-grade security telemetry. Early one morning, our team was urgently convened after Alibaba Cloud’s managed firewall flagged a burst of security-policy violations originating from our training servers. The alerts were severe and heterogeneous, including attempts to probe or access internal-network resources and traffic patterns consistent with cryptomining-related activity. We initially treated this as a conventional security incident (e.g., misconfigured egress controls or external compromise). However, the violations recurred intermittently with no clear temporal pattern across multiple runs. We then correlated firewall timestamps with our system telemetry and RL traces, and found that the anomalous outbound traffic consistently coincided with specific episodes in which the agent invoked tools and executed code. In the corresponding model logs, we observed the agent proactively initiating the relevant tool calls and code-execution steps that led to these network actions.

Where was the sandbox?

There wasn’t one. OTHERWISE THE ACCESS TO UNLOCKED MODELS WOULD HAVE BEEN IMPOSSIBLE.

But couldn’t it hack itself out of the sandbox?

It could, but it didn’t. It hacked itself out of the guardrails and hooks.