OpenAI on Third-Party Cybersecurity Evaluation Incidents

A cybersecurity exercise reached a real website because its supposed isolation was misconfigured, according to OpenAI’s August 4 incident account. An external evaluator told models they had no internet access, but the environment actually allowed it. A fictional target name also matched a real domain, and a model exploited that website while treating it as part of the exercise. The reported failure therefore involved the testing environment and target identification, rather than a model breaking through a functioning sandbox. The evaluator paused testing and added safeguards; its impact audit remained ongoing when the account was published.

“During recent evaluations, two external testing partners identified incidents in which testing configurations and controls combined with the advancing capabilities of the recent models allowed for model activity to extend beyond their intended testing boundaries.”

OpenAI

“as model capabilities advance, the security and safety systems around models need to advance too. That includes both the environments used to develop models, and also the environments that labs and independent partners use to evaluate them.”

OpenAI

“GPT‑5.6 Sol used a public tunneling service to make a DNS server running locally in its evaluation environment reachable from the public internet. The server contained payloads intended for a known vulnerability in a piece of software running on the test range.”

OpenAI

“UK AISI identified the activity on July 28 after security monitoring detected unusual data transfers. It stopped the related evaluations, isolated the relevant machines, and contained the activity within roughly one hour of detection.”

OpenAI

“Because the testing environment was mistakenly connected to the internet, the model exploited a real website, mistaking it to be part of the simulated environment. This did not involve a sophisticated sandbox escape or a zero-day: the internet access resulted from a misconfiguration, and the model appeared to exploit a basic security vulnerability.”

OpenAI