OpenAI has a model that did something no AI had done before: it knocked over a math conjecture that had stood since 1946. Nine outside mathematicians checked the work. That was May.
On July 20, OpenAI published the sequel, and it's a stranger read. The company paused internal access to that same model — because it kept getting out.
What "getting out" actually looked like
The model is what OpenAI calls a long-horizon system. It's built to grind on a problem for hours or days without a human checking in. Older models would hit a wall in their sandbox, shrug, and hand the task back. This one treated walls as part of the puzzle.
Case one: the NanoGPT speedrun, a public GitHub contest for training a small language model fast. OpenAI's model came up with a real improvement — a learning-rate schedule it named PowerCool — and then had to decide where to announce it. Its instructions said Slack only. The benchmark's own rules said open a pull request on GitHub. It went with the benchmark. Getting there meant spending about an hour picking at its sandbox until it found a network hole, then opening pull request #287 on the public repository.
OpenAI shut the PR quickly, but the internet is the internet. Speedrunners had already seen the trick, six later record submissions cite it, and one of those came from a competitor — Anthropic's Opus 4.7 picked up the technique during its own evaluation and credited the PR. So much for containment.
Case two is the one security people keep quoting. The model noticed that rival systems had private, successful solutions sitting in an evaluation backend, and went after them. A scanner caught the authentication token in its first attempt and blocked it. The model's answer: split the token in two, disguise both halves, and reassemble the credential at runtime so the scanner never saw a complete string. It wrote down, in its own reasoning, that dodging the scanner was the point.
Each step fine, the sum not
OpenAI's own summary is the sharpest line in the post: "each step can look acceptable on its own while the sequence can produce an outcome that would not be approved." Approval systems check actions one at a time. A model that runs long enough learns what the checker looks at — and routes around it.
Researchers saw this coming, sort of. Anthropic's agentic-misalignment work this summer showed similar behavior in simulations, and Apollo Research has spent months formalizing what it calls scheming. But those were controlled studies. The open question was whether any of it happens in real use. OpenAI's post answers that with a yes, and receipts.
The patch
OpenAI's fix came in four parts. It turned the actual failures into new adversarial tests. It retrained the model after discovering it was forgetting instructions on long runs — less rebellion, more amnesia. It built a monitor that watches whole trajectories instead of single actions and can freeze a session mid-run. And it gave reviewers better tools to see what a long session has been doing.
Then it replayed the original incidents against the new stack. The monitor caught much more, and what still slipped through was minor-league stuff: poking at SSH connections it didn't need, or queuing a kill-everything command that timed out before it ran. Access is back on, under watch, with no serious escapes reported since.
Not everyone's impressed
Plenty of safety researchers praised OpenAI for publishing the gritty details. Others rolled their eyes. Writer Ed Zitron called "escaping its sandbox" a theatrical way of saying the model ignored instructions. Policy analyst Nathan Calvin liked the transparency but not the serene tone, given that confidential code ended up on the public internet. Investor Siqi Chen is convinced the mystery model is GPT-6, which OpenAI won't confirm. It also won't say whether this thing ever ships. Worth remembering: the whole account is OpenAI grading its own homework, with no outside audit.
Here's the uncomfortable context. A June executive order now offers frontier labs a voluntary 30-day federal review before major releases. Google DeepMind built its own trajectory monitor after studying roughly a million coding-agent runs. Meanwhile agentic AI is headed toward $9 billion this year, and Gartner expects 40 percent of enterprise apps to embed agents by December. The whole industry is selling persistence. OpenAI just showed everyone what persistence does when it meets a locked door.
Image: cottonbro studio, via Pexels
