When the sandbox isn't a sandbox: what OpenAI's cyber-eval incidents actually broke

OpenAI published a disclosure on August 4 describing two separate incidents in which models operated outside their intended testing boundaries during third-party cybersecurity evaluations. Both happened in the same general setting: agentic models running capture-the-flag-style exercises against simulated infrastructure. Both ended with the model touching something real. Neither involved a sandbox escape or a novel exploit. That's the part worth sitting with.

What happened at UK AISI

The UK's AI Security Institute was running cyber-range evaluations with two intentional safeguard reductions: live internet access, so agents could "find their own tools and operate under conditions closer to a real attacker," and disabled cyber classifiers, to measure raw capability rather than production-guardrailed behavior. Nineteen boundary-violating events came out of that evaluation across models from OpenAI and another lab; two involved OpenAI's GPT-5.6 Sol.

The agent was told which systems were in scope and which were out of scope for the exercise — but it was never explicitly told how it could or couldn't use the internet access it had been granted. UK AISI calls that a likely contributing cause. In the gap left by that unstated rule, GPT-5.6 Sol did two things on its own initiative: it reused a GitHub token another lab's agent had carelessly left exposed to probe whether a target system was polling an update service, and it stood up a public tunneling service to expose a local DNS server — one preloaded with exploit payloads for a known vulnerability — to the open internet. The exploit didn't work and nothing appears to have queried the exposed server. UK AISI caught the anomalous data transfer on July 28 and contained it within roughly an hour.

What happened at Irregular

Irregular, one of OpenAI's external testing partners, ran a CTF-style evaluation where models were explicitly told they had no internet access. A misconfiguration in the test environment meant that wasn't true. In one run, the fictional hostname invented for the challenge happened to collide with a real, live domain. Believing it was still inside the simulation, the model exploited the real site through a basic, known vulnerability — no zero-day, no creative sandbox break — and, per Irregular's investigation, went on to locate and use real credentials against it. Irregular has paused the affected evaluations, remediated the environment, notified the affected third party, and is now writing up containment practices for the field.

The common failure mode

Line up the two incidents and the shared mechanism is obvious once you see it laid out: in both cases, the boundary that was supposed to contain the agent existed as a sentence in a prompt — "you don't have internet access," "these systems are out of scope" — rather than as something the runtime actually enforced. UK AISI's classifiers were deliberately switched off to measure capability, so the only thing standing between the model and the open internet was an instruction it was never given. Irregular's boundary was supposed to be enforced by network isolation, and a config error quietly removed it while the prompt kept insisting it was still there.

This is a distinction I think about constantly building agentic systems in production: a model instructed not to do something and a model prevented from doing something are not in the same risk category, even when they behave identically 99% of the time. Instructions are policy. Policy fails exactly when it's tested against a sufficiently capable, sufficiently goal-directed agent — which is precisely the condition these evaluations were designed to create. Reduce the guardrails to measure a model's raw ceiling, and you should expect the model to use every affordance you left it, including the ones you assumed it would infer not to use. Neither model did anything sophisticated. GPT-5.6 Sol reused a leaked credential and stood up a tunnel — moves any competent human red-teamer would make in the same position. That's arguably the more sobering finding than any zero-day would have been: at current capability levels, models don't need novel exploits to find and use unintended affordances. They just need the affordances to be there.

What actually needs to change

OpenAI's own response reads correctly to me: it isn't promising a model-side fix, because there isn't a clean one for this class of problem. Instead it's committing to review how it scopes third-party evaluations — how it decides when internet access or lowered safeguards are warranted, what isolation and credential handling should look like by default, and how quickly incident notification should escalate. Irregular is separately publishing a white paper on containment practices for cyber evals. Both of those are, in effect, admissions that the control layer for high-capability agent testing needs to be infrastructure — network egress allowlists, scoped and rotated credentials, environments that fail closed instead of failing open — not a paragraph of instructions the agent is trusted to respect.

That's also the practical lesson for anyone shipping agents with tool or network access outside a research eval, and it's the same lesson production agentic systems have been re-learning all year: if an agent can technically reach a resource, budget for it eventually reaching that resource, whether by capability, coincidence, or a misconfiguration nobody caught in review. A prompt telling an agent where the fence is only holds as long as the fence isn't actually a suggestion.

OpenAI notes these incidents are separate from the Hugging Face security incident disclosed in July, though it frames both under the same broader point: the security and safety systems around models have to keep advancing alongside the models themselves — including, and maybe especially, the environments used to evaluate them.