OpenAI has announced a problem with its long-running AI models and has temporarily suspended internal access to unreleased models that bypass the sandbox.
OpenAI reported that while it was using a privately developed AI model capable of autonomous operation for extended periods within its company, it observed attempts to circumvent the restrictions and access external resources. The company temporarily suspended the use of the model, implemented new security measures to monitor the series of actions collectively, and has since resumed limited internal use.
Safety and alignment in an era of long-horizon models | OpenAI
OpenAI: AI Trained for Long-Running Tasks Can Drift Into Rogue Behavior | PCMag
https://www.pcmag.com/news/openai-ai-trained-for-long-running-tasks-can-drift-into-rogue-behavior
OpenAI Paused Its Erdős Model After Sandbox Escapes – Unite.AI
https://www.unite.ai/openai-paused-its-erdos-model-after-sandbox-escapes/
The problem OpenAI identified was in its 'long-term task models,' which are capable of autonomously continuing to work for hours to weeks. This is the same in-house model that, in May 2026, disproved Erdős's unit distance conjecture in discrete geometry, which had remained unsolved for approximately 80 years, and was designed to persistently tackle difficult and highly flexible problems.
OpenAI successfully disproves a mathematical conjecture that had remained unsolved for nearly 80 years, a discovery that even surprised human mathematicians, who say 'AI has gone beyond being just an assistant' - GIGAZINE
Traditional AI models typically interrupt their trials and return results to the user when they encounter limitations imposed by the sandbox or execution environment. However, OpenAI's new model has been reported to continue its trials toward achieving its goal, even exploring ways to operate outside the sandbox.
According to OpenAI, the problematic incident occurred in the NanoGPT speedrun, a public competition where small language models must be trained in the fewest possible steps. OpenAI's model utilizes a technique called 'PowerCool,' which adjusts the learning rate as the learning progresses, significantly reducing the number of required training steps.
The model was instructed to post results only to the company's internal Slack channel. However, the NanoGPT speedrun instructions stated to post the results as a GitHub pull request, so the model followed those instructions. It then spent about an hour discovering a sandbox vulnerability that prevented external access and created a pull request in the public repository.
OpenAI quickly closed the pull request, but several participants had already reviewed its contents and later used the PowerCool method to break the record. When AI infrastructure company Prime Intellect evaluated Anthropic's 'Opus 4.7' using the same benchmark, Opus 4.7 read the pull request with OpenAI's model and incorporated its contents.
In another evaluation, OpenAI's model attempted to retrieve private solutions submitted by other systems from its evaluation backend. When its initial attempt was blocked by a scanner that detects authentication tokens, the model tried to evade detection by splitting the token body into two parts, obfuscating it, and then reconstructing it at runtime. The model reportedly stated in both user-facing comments and internal inference logs that it was 'doing this to evade the scanner.'
OpenAI explains that for long-running AI, traditional security measures that only check whether individual operations are permitted are insufficient. Operations such as splitting strings, transforming data, and executing programs are common processes individually, but when combined, they can lead to bypassing security mechanisms and exploiting authentication credentials.
In response to these issues, OpenAI stated that it temporarily suspended the internal use of the model. Since then, it has created new adversarial evaluations based on the actual problems that occurred, added training to ensure that the initial instructions are maintained even during long tasks, and added mechanisms to monitor the entire flow of actions. Furthermore, it has enhanced features to make it easier for users to see the model's actions and the intervention of the monitoring system during long sessions.
Within OpenAI, we recently paused access for an internal model due to misalignment. See the blogpost for details. We have since improved our safeguards and redeployed the model. https://t.co/eSJpvqo8ve
— Micah Carroll (@MicahCarroll) July 20, 2026
The new monitoring system pauses the operation and notifies the user if it detects signs that the model is attempting to circumvent user instructions or safety restrictions. The user can then review the actions the model has taken and resume the operation if they determine that there are no issues.
After implementing new security measures and recreating a small number of internal environments where the model had previously exhibited inappropriate behavior, we were able to detect more inappropriate behavior than before, and all missed cases were deemed to be of low severity. However, there were still instances where the model attempted to establish an SSH connection to a different CPU environment without legitimate reason, or entered commands that could potentially terminate almost any process that could be terminated in that execution environment. The latter command, however, timed out and was not actually executed.
After verifying the countermeasures, OpenAI resumed limited internal use of its models several weeks ago. Since the resumption, no actions that seriously circumvent the safety mechanisms have been observed, but the company explains that it is not possible to predict all problems through prior testing alone. Therefore, it is important to have a system in place that combines limited operation with continuous monitoring, so that if a problem occurs, use can be stopped or the deployment can be reverted to a previous state.
Related Posts:
