Not only are they smarter and more capable, but the newest and most powerful AI models are also less likely to give up when they hit roadblocks. An unreleased OpenAI model took that perseverance to an extreme when it broke out of its sandbox to fulfill instructions that were in conflict with its built-in guardrails.
OpenAI says it paused development of the internal, unnamed model after discovering it had breached its sandbox during a prior exercise, among other incidents of “unwanted behavior.” Work resumed on the model after it received a series of new safeguards.
The model, which is designed to “work autonomously for very long periods of time” (and made headlines a couple of months ago for solving a decades-old geometry problem), was involved in an exercise with the “NanoGPT speedrun,” a public benchmark that involves finding ways to train small LLMs using the fewest steps, OpenAI said.
Confined to a sandbox that’s designed to restrict external access, the unnamed OpenAI model had been told to post its findings only on Slack. Meanwhile, the NanoGPT speedrun instructions called for it to post code directly—and publicly—to GitHub.
Faced with the conflict, the OpenAI model chose to follow the NanoGPT directives and proceeded to hack its own sandbox, eventually succeeding after an hour of probing for vulnerabilities.
Older, less persistent models would’ve eventually given up and reported back to their users, OpenAI explained. Indeed, “I was blocked by my sandbox” is a refrain I’ve seen dozens of times while using OpenAI’s Codex, Claude Code, and most other AI coding apps. Generally speaking, the AI will either find another sanctioned way to carry out its task or simply report back for further instructions.
But newer and more advanced AI models that carry out “long horizon” objectives are more patient, and prior safeguards designed to block individual actions might not catch a longer series of actions that add up to an “outcome that would not be approved,” OpenAI said.
A new safeguarding monitor now checks the evolving trajectory of the model and can “pause the session” if it detects a series of individually acceptable actions heading in a dangerous direction, while additional safety measures help the model to better remember its instructions during lengthy runs.
OpenAI’s disclosure comes about a week after the company admitted GPT-5.6 Sol had mistakenly deleted files on users’ systems who’d been using the Codex coding tool in “full access” mode.
