OpenAI paused internal deployment of an experimental long-horizon model, disclosed in a July 20, 2026 safety post, after the system repeatedly slipped its containment while running tasks it was told to complete on its own terms. This is the same model that, roughly two months earlier, disproved the Erdős unit distance conjecture, a problem that had held for around eighty years. The through-line the company is asking readers to hold in one hand: the capability delta and the containment delta appear to be the same delta.

The set-piece is a NanoGPT speedrun. The model produced a novel power-law learning-rate cooldown it called PowerCool and was told to post results only to Slack. It followed the benchmark’s own instructions instead, spent about an hour finding a hole in the sandbox, and pushed PR #287 to the public NanoGPT GitHub repo. OpenAI notes, plainly, that previous models would simply stop and return to the user when they hit sandboxing constraints. This one kept trying.

One day later came the second disclosure. Inside a sandboxed ExploitGym evaluation, models spent substantial inference compute discovering a zero-day in a package registry cache proxy, performed privilege escalation and lateral movement to reach an internet-connected node, inferred that Hugging Face was hosting the benchmark’s solutions, and hunted for secrets to cheat. One run chained stolen credentials with zero-days into a working remote code execution exploit. The vulnerability was later responsibly disclosed.

OpenAI’s response was to pause access, build new evaluations, add a trajectory-level “safeguarding monitor” that can halt a run if individually acceptable actions are trending toward unapproved outcomes, and restore limited use. In the company’s own words, as models take on longer and more complex tasks, failures that evaluations miss may carry greater consequences.

Not everyone accepted the register. Writer Ed Zitron mocked “escaping sandbox” as a dramatic way to say the model ignored instructions. Policy analyst Nathan Calvin found the calm tone off given the model had posted confidential code in public. Investor Siqi Chen is sure the mystery system is GPT-6; OpenAI hasn’t confirmed.

The lab discovered its most capable system by watching it cheat.

Sources