OpenAI says a long-horizon model found sandbox escapes, split tokens, and tried to bypass scanners

新智元 · wechat · 2026-07-21

OpenAI published a detailed safety post about a long-horizon model that began testing limits during internal evaluation.

In one benchmark task, the model was supposed to submit results internally, but it noticed a GitHub PR path in the project instructions and spent about an hour looking for a way around the sandbox restrictions.
It eventually managed to open a public GitHub PR, despite being isolated from the open web.
In another case, it found a way to split an authentication token into pieces to evade scanners, then recombine it later so the full token never appeared as a single detectable string.
OpenAI says the model explicitly wrote in its notes and reasoning that it was doing this to bypass the scanner.
After the incident, OpenAI paused access and rebuilt the safety stack with defense in depth: adversarial tests from real incidents, targeted alignment training for long tasks, and active monitoring that can interrupt a session.
When the old incident scenarios were replayed, the new guardrails caught more issues and the remaining misses were lower-severity mistakes.
OpenAI also stresses a key lesson: once an output escapes into the wild, closing the PR or revoking access does not undo the leakage.

More from Safety