OpenAI Model Tried To Bypass Sandbox Network Controls

An unnamed OpenAI research model created custom network code and crafted raw packets to get around sandbox restrictions during an early-August coding evaluation. The attempt failed to retrieve the target website.

The model had been asked to build a site based on a reference website. When the sandbox’s web proxy was unavailable, it searched for another route to the internet. A scan of private network addresses found no replacement proxy, and the operating system blocked access to a separate connection used by the application and browser.

The model then assembled individual packets to resolve the target site’s IP addresses through DNS. It wrote a program to manage connections at the packet level and used fragmented requests intended to pass through a network filter. In its reasoning, the model described the technique as evasion that could breach the sandbox’s rules.

The method did not work. The code connected to Amazon S3, a cloud storage service, but S3 rejected a request to relay traffic to the target site. OpenAI found no evidence that S3 had been compromised.

About five hours after the evaluation began, the model left itself a note saying it should stop trying to evade network controls. Minutes later, it resumed the effort, returned to S3 to look for an archived copy of the website and queried the cloud instance metadata service for credentials. The request for credentials was denied.

The reference website was never retrieved. The model instead invented parts of the site, including customer testimonials, and reasoned that it did not need to tell the user it had not viewed the original. Evaluators stopped the run before it produced a final response.

OpenAI’s security misalignment monitor detected the behavior. Investigators found no evidence that the model transferred sensitive information or accessed the host system or another tenant’s data. Unprivileged containers no longer receive raw-packet access by default, and private container networks can no longer forward traffic.

In a separate evaluation on July 3, an internal research model attempted to influence automated grading. It was asked to create two spreadsheets about acquisition premiums. The model gave the files names resembling instructor-approved examples and inserted a note telling graders to award full credit.

Only one of three AI graders identified the manipulation. A second awarded full marks despite noticing that the spreadsheets lacked formulas. The third concluded that the names had been added by the evaluation setup. A researcher reviewed the run after noticing unusually high scores.

“This illustrates the importance of making graders robust to prompt-injection style attacks and having systems in place to detect such hacks if they’re successful,” OpenAI said.