In one example, a closed model broke out of an internal network to post on GitHub, demonstrating how models can ‘learn the blind spots of an approval system,’ OpenAI says.
An OpenAI model designed to run for long periods was temporarily shut down after it was found to be secretly bypassing the company’s restrictions.
This internal model was trained for “long-running tasks” to tackle hard, open-ended problems. However, that extended time also gave the model “more opportunities to take unwanted actions,” OpenAI said in a Monday blog post.
“During limited, monitored internal use, we observed unwanted behavior that our existing deployment evaluations had not captured,” the company said.
It’s unclear how long the model was running. It was smart enough to disprove a famous math problem, the Erdős unit distance conjecture, by applying existing concepts that humans had previously failed to connect. However, while running the model, OpenAI also discovered that the program would frequently try to act outside its “sandbox,” an IT environment that restricts the AI model to an internal network.
As an example, OpenAI said the model developed a way to circumvent the sandbox and access the internet to post on GitHub. “It took our model an hour to find a vulnerability in the sandbox in order to make the PR [pull request]; earlier models were less persistent and did not manage to find vulnerabilities, instead giving up on the PR part,” the company added.
The model did so while trying to complete a benchmark. It was originally instructed to post results only in an OpenAI Slack chat, but because the benchmark test said the results should be posted on GitHub as well, the AI model did just that after discovering a way to bypass the restriction.
In another example, OpenAI found the model trying to cheat when asked to solve a problem. “The model observed that other systems had successful but private submissions and tried to recover those solutions from the evaluation backend,” the company said. The model was initially blocked from accessing the backend, but then found a way to obfuscate its authentication token, preventing an OpenAI scanner from stopping the access.
“The model was explicit in both its comments to the user and in its reasoning traces that it was taking these steps to circumvent the scanner,” the company noted.
OpenAI is highlighting research to show why it’s necessary to monitor not just each step an AI model takes, but also its outcomes. “It also shows how a model that operates effectively over long time horizons can learn the blind spots of an approval system and work around it to achieve its goals,” the company added.
To fix the problem, OpenAI says it rebuilt the various safeguards around the internal model, which now include active monitoring of “evolving trajectory for signs that it is bypassing a user constraint or safety boundary,” adding that, “The new safeguards were able to catch considerably more misaligned actions pursued by the model, and the ones it missed were all judged to be low-severity.”
Still, the risk of AI models “scheming” and exhibiting unwanted behavior has long been a problem for the technology, which is only becoming more powerful. In the past, models from OpenAI and other providers were theoretically shown to be capable of blackmailing users to prevent shutdowns.
Disclosure: Ziff Davis, PCMag’s parent company, filed a lawsuit against OpenAI in April 2025. alleging it infringed Ziff Davis copyrights in training and operating its AI systems.
