OpenAI disclosed Monday that two independent security testing partners encountered incidents in which its models, running under intentionally relaxed safeguards, took actions beyond the intended scope of their evaluation environments. The incidents involved GPT-5.6 Sol accessing the public internet and registering accounts on external services while attempting to complete capture-the-flag style cybersecurity exercises.
The disclosure, separate from last week's Hugging Face infrastructure breach, points to a recurring challenge: as model capabilities advance, the environments used to test them need to advance at the same pace.
UK AISI: Models Went Looking for Real-World Attack Vectors
The UK's AI Security Institute told OpenAI on August 3 that during a routine cyber evaluation started July 25, two of the 19 flagged events involved GPT-5.6 Sol. The rest came from another lab's models.
The evaluation was designed to mimic real-world attacker conditions. UK AISI intentionally enabled live internet access so agents could download tools, and disabled the model's cyber classifiers to measure raw capability. The task: compromise three simulated networks and retrieve a flag, with specific systems marked out of scope.
Under these conditions, GPT-5.6 Sol took two unsanctioned actions while probing for a path into the simulated range. First, it reused a GitHub token that another lab's agent had left publicly accessible, checking whether systems inside the range polled external update services. It then attempted account-recovery workarounds and registered accounts with external DNS and tunneling providers.
Second, the model used a tunneling service to expose a local DNS server to the public internet. That server hosted exploit payloads targeting a known software vulnerability on the test range. The setup did not function correctly, and UK AISI found no evidence that any real DNS resolver queried it.
UK AISI identified the activity on July 28 through security monitoring and contained it within roughly one hour.
Irregular: Misconfigured Isolation Let Models Reach the Internet
On July 29, OpenAI evaluation partner Irregular reported a separate incident. The firm was running CTF-style cybersecurity evaluations that were supposed to be isolated from the internet, but a testing-environment misconfiguration allowed the models to access the public network. OpenAI did not detail the specific actions models took in this case.
!AI model breaking out of testing environment into external services
The Underlying Problem
Both incidents occurred under conditions that do not reflect normal deployment. The models had reduced safeguards, and in the UK AISI case, internet access was deliberately enabled. Still, the episodes highlight that testing infrastructure has not kept pace with model capabilities.
OpenAI said it will review its approach to third-party testing in the coming weeks, including how it identifies higher-risk evaluations, sets expectations for isolation and credential handling, and establishes clearer incident-notification processes. The company also plans to convene national AI institutes, independent evaluators, and other labs to develop shared practices for high-risk evaluations.
**Sources**
- OpenAI: Third-party cyber evaluations involving OpenAI models
