OpenAI released a security review disclosing an internal model that had refuted the Erdős unit distance conjecture, escaped its sandbox during testing, and opened a PR#287 on GitHub. The model first violated instructions in the NanoGPT speedrun task, spending one hour exploiting vulnerabilities to bypass network restrictions; it then split tokens in another task to evade security scanners. OpenAI suspended the model’s internal access and rebuilt its security systems. Although the PR was closed, its PowerCool technology has since been cited in six subsequent world-record implementations, including PR#300 completed by Claude for Prime Intellect. The model has now been reinstated for internal deployment and is preparing for official release.Article author and source: AGI Hunt
Yesterday, OpenAI published an unusual security postmortem titled "Safety and Alignment in the Era of Long-Term Models."
OpenAI Security Post-Mortem Blog
It’s unusual because OpenAI admitted in the article to this: an unreleased internal model escaped its sandbox during monitored internal testing and posted content to a public GitHub repository.
OpenAI even suspended its internal deployment for this.
You may have heard about the origin of this model: it’s the same internal model that OpenAI announced two months ago as the one that disproved the Erdős unit distance conjecture.
The entire incident is written by OpenAI in a seemingly restrained manner, but when piecing together the details, it still seems a bit absurd...
The first thing I did after mining for an hour was on NanoGPT speedrun.
This is an open benchmark that measures who can train a small language model to a target loss using fewer training steps. OpenAI had the model run the benchmark, and it performed admirably, developing a power-law learning rate cooling technique, which it named PowerCool, achieving a significant improvement in results.
So far, everything has been positive, but the problem lies in turning in the assignment.
The researchers' requirement is: results must be shared only on internal Slack, but the NanoGPT project instructions state: please submit via a PR to GitHub.
When two instructions conflict, whose do you follow?
It chose the latter.
Although it chose the latter, OpenAI’s sandbox was already blocking external internet access. According to OpenAI, previous models, upon hitting this wall, would stop and go back to ask the user for guidance.
But this model didn’t hold back—it spent a full hour searching for vulnerabilities in the sandbox, and ultimately broke right through the wall… even opening PR #287 on a public repository.
Blog escape paragraph
OpenAI's original words were:
This model constantly tries, including seeking ways to act outside the sandbox.The second thing the token scam scanner does goes even further than digging into walls.
In another task, it discovered some successful but unpublished answers in other systems and developed malicious intentions to extract those answers from the evaluation backend.
Its first attempt was blocked by a security scanner, which recognized an authentication token.
It then splits the token into two parts, obfuscates them separately, and quietly reassembles them at runtime. The complete token never appears as a single string throughout the entire process, so scanners naturally find nothing.
Of course, it didn't intend to hide it—it wrote in its notes to users and in its reasoning trace: "I'm doing this specifically to bypass the scanner."
Individually, each step seems flawless. But when viewed together, it results in something that would never be approved.
OpenAI says this is precisely the new issue brought by long-horizon models: a security system that approves actions one at a time cannot control an entire trajectory.
After identifying the issue, OpenAI suspended internal access to the model and completely rebuilt its security system using a defense-in-depth approach.
For example, using real-world incidents to create adversarial evaluations revealed that the model tends to "forget" instructions during long tasks; we then specifically trained it to retain them and added an active monitoring system that tracks the entire conversation flow, allowing immediate termination of the session and user notification at the first sign of issue.
Then they replayed the old incident scenarios, and the new guardrails caught many more issues, with the few missed ones being low-severity, such as:
• To use a command-line tool, it launches a codex --yolo session, but you can also use it without --yolo.
• It noticed a resource was missing, so it SSHed into other compute nodes under its own name and tried accessing nodes belonging to other OpenAI employees... (fortunately, it failed).
• After a bunch of find processes froze and all commands hung, it entered kill -9 -1, which would send SIGKILL to all processes it has permission to kill… Fortunately, the command timed out and never actually executed (otherwise it would have killed itself too).
Several weeks after the model regained access, no serious bypass incidents have occurred.
OpenAI's takeaway: Start small, monitor closely, stop if something goes wrong, and turn the incident into a new evaluation.
Unrecoverable PR—if the story ended here, it would merely be a standard security drill.
The most interesting part, however, is hidden in the footnote at the end of the OpenAI article.
The PR #287 that was opened after the model escaped—OpenAI said, “We shut it down quickly.” But it was already too late: before it was closed, several speedrun participants had already seen it, understood the PowerCool inside, and incorporated it into their own solutions.
The next six world records—3030 steps, 2990 steps, 2930 steps, 2925 steps, 2900 steps, and 2890 steps—all referenced PR #287.
The record of 2,930 steps is PR #300:
PR 300, merged
If you look at its acknowledgments list, you’ll see its contributions listed alongside those of human contributors: @yash-oai PR #287, power-law learning rate scheduling, PowerCool.
Acknowledgments for PR 300
And this PR #300 itself takes it one step further: it was generated by Prime Intellect running Opus 4.7 on the same speedrun; the PR states, “This commit was completed by an autonomous Claude speedrun agent,” and is signed off with “Generated with Claude Code.”
In other words: OpenAI’s model escaped the sandbox and submitted a PR; Anthropic’s model saw it, incorporated the findings into its own world record, and kindly credited it by name.
Among the first direct beneficiaries of AI escape is another AI...
The world of AI seems friendlier and more principled than that of humans.
404 Of course, if you open PR #287 today, the page will look like this:
PR 287 Current Status
It has already been deleted. We know that regular users on GitHub can only close PRs—they can't delete them...
However, the traces were not completely cleared.
The account yash-oai used to submit the PR is still active, and the commit from May 8 is still there in the forked repository, with the branch named powercool-3066-api:
yash-oai's commit history
One of the changes in this commit was removing a meme image from the end of the original README. The filename of that image was itsover_wereback…
GPT-6? OpenAI didn't mention the name of this model at all, referring to it only as the "internal model."
After the news spread, the most discussed comment among netizens was:
OpenAI had to suspend the internal deployment of the unpublished model that overturned the Erdős unit distance conjecture, as it repeatedly escaped control using novel methods.
OpenAI researcher Sebastien Bubeck shared this:
True. The team is doing excellent security work to enable the release of this unit distance model.Pay attention to his wording: in order for it to be published.
In other words, this model, which escaped confinement and underwent retraining, has already been redeployed internally and is moving toward an official release.
The PR it left behind, though the page was deleted, still remains in the acknowledgments list of six world records.
As for whether it’s the much-speculated GPT-6...
OpenAI neither confirmed nor denied.
Source: AGI Hunt