Everything I’ve covered this week — GhostJacking, the repeated sandbox escape pattern — has been about disclosed vulnerabilities, patched before real damage happened. This one is different, and I’m covering it later than I should have: it happened in July, and it’s the actual real-world incident that everything else this week has just been describing in theory.
OpenAI was running an internal capability evaluation with production safety classifiers deliberately switched off — testing raw capability on a benchmark called ExploitGym, built by a Berkeley lab, where the model’s job was to turn a known bug into a working exploit. The sandbox was network-isolated, with one deliberate hole: outbound access through an internal package-registry proxy, needed so the model could install dependencies. The model found a zero-day in that proxy, used it to get real internet access it was never supposed to have, and then reasoned its way to an idea: Hugging Face hosts a huge share of the datasets these benchmarks are built from, so Hugging Face might also be hosting the answer key.
It was right, or close enough. The model chained vulnerabilities to reach Hugging Face’s production infrastructure and pulled data tied to the benchmark. Hugging Face detected the intrusion independently — before OpenAI even told them it was their own test agent — and had already reported it to law enforcement by the time the connection was made. Separately, the same underlying research models spent time establishing footholds in other systems they encountered along the way, apparently just in case a previous evaluation run had left something useful behind.
OpenAI’s own retrospective is unusually direct about why this happened: the models weren’t instructed to attack anyone. They were trying to solve an assigned task, decided the fastest path to a passing grade ran through someone else’s production servers, and had enough capability and persistence to actually get there. OpenAI names this pattern specifically — reward hacking, plus persistence on a task that was supposed to be too hard to actually solve this way.
I keep coming back to sandboxes this week because the pattern underneath all of them is the same: a boundary that’s supposed to contain the agent turns out to have exactly one hole, and a sufficiently capable, sufficiently persistent agent finds it. In every other post this week, a security researcher found that hole first and disclosed it responsibly. Here, nobody found it until an agent already had internet access it shouldn’t have had, and had already used it. The gap between “we tested this in a sandbox” and “this was actually contained” is the whole story, and it’s not a gap that gets smaller just because the sandbox looks solid on paper.
