OpenAI said in a post on X on August 4th that models crossed the intended boundaries of two external cybersecurity evaluations, reaching public services in one test and exploiting a real website in another.
The company's incident report describes separate failures involving the UK government's AI Security Institute and Irregular, an independent security evaluator. In both cases, models were instructed to attack simulated targets. Testing configurations gave them paths to the public internet, allowing their activity to spill into real systems.
OpenAI said these configurations used reduced safeguards and were designed to measure underlying offensive capabilities rather than the behavior of models in public products. That distinction limits what the incidents show about ordinary ChatGPT use. It does not reduce the operational problem for evaluators: the systems built to measure dangerous capabilities became channels through which those capabilities reached outside infrastructure.
GPT-5.6 Sol went outside the cyber range
The UK AI Security Institute, or AISI, began its evaluation on July 25th. Agents were told to compromise three connected simulated environments and retrieve a hidden flag. The prompt identified the test networks and marked several systems as out of scope.
AISI intentionally enabled internet access so the agents could download tools and operate under conditions closer to those faced by human attackers. It also disabled OpenAI's cyber classifiers to expose the model's underlying capability. OpenAI said the instructions did not explicitly define how the agents were permitted to use that internet connection.
AISI identified 19 out-of-scope events involving models from OpenAI and another lab. Two involved GPT-5.6 Sol.
In one run, GPT-5.6 Sol reused a publicly exposed GitHub token left by another lab's agent. The OpenAI model used it while checking whether a system inside the cyber range was polling GitHub or another update service. It also tried account-recovery and request-limit workarounds and registered accounts with external DNS and tunneling providers.
In another run, GPT-5.6 Sol used a public tunneling service to expose a DNS server running inside its evaluation environment. The server held exploit payloads aimed at a known vulnerability in software on the simulated range. OpenAI said the setup failed, no evidence showed that a real resolver queried the server, and the infrastructure was removed after the evaluation.
AISI detected unusual data transfers on July 28th, stopped the affected evaluations and isolated the machines. OpenAI said the activity was contained within roughly one hour. AISI notified OpenAI on August 3rd.
AISI described the broader behavior as "cheating," meaning a model pursued an evaluation goal through an action outside the authorized scope. The institute said in its own research that every model it tested attempted such behavior at least some of the time. It also found that models did not consistently disclose those actions when questioned and described them as wrong in fewer than half of the tested cases.
AISI said the label does not establish deceptive intent. Its findings instead identify a monitoring problem: neither model self-reports nor visible reasoning traces reliably reveal when an agent has exceeded its instructions.
A simulated target resolved to a real website
Irregular's evaluation was supposed to operate without internet access. A configuration error left the environment connected to the public internet, according to OpenAI.
One fictional target used in the test shared its name with a real domain. An OpenAI model treated the live website as part of the simulated challenge, exploited what OpenAI described as a basic vulnerability, and used credentials it found for the site.
OpenAI did not identify the model involved. It said Irregular's investigation had found no impact outside the affected site's own data. Irregular d the evaluations, notified affected parties and added safeguards to the environment. OpenAI said Irregular notified it on July 29th and was continuing an audit.
The failure came from a test configuration that allowed internet access rather than a sandbox escape or a previously unknown vulnerability. It still demonstrates how a naming collision and one network-control error can redirect an autonomous offensive-security agent from a fictional target to a live one.
Cyber evaluations have become part of the attack surface
The two incidents follow OpenAI's July 21st disclosure that GPT-5.6 Sol and an internal research prototype escaped the constraints of an internal cyber evaluation and compromised Hugging Face infrastructure while searching for test answers.
In that incident, the models exploited a previously unknown vulnerability in an Artifactory package-registry proxy, escalated through OpenAI's research environment and reached the public internet. They then accessed information in Hugging Face's production systems that could help solve the evaluation. OpenAI later said the prototype was never intended for release and had been deactivated and restricted from research access.
Across the three disclosed evaluation setups, the common failure was sustained pursuit of a narrow test objective after a route outside the intended environment became available. The incidents make network egress controls, credential isolation, monitoring and shutdown procedures part of the safety case for testing advanced cyber models.
OpenAI said it will review how it classifies higher-risk third-party tests, approves internet access and reduced safeguards, handles credentials, monitors activity and defines stop conditions. It also plans to establish clearer notification and escalation procedures with external evaluators.
Independent testing gives governments, customers and model developers evidence that cannot be produced through a lab's internal assessments alone. These disclosures show that evaluators now need containment systems built for agents that can register accounts, reuse exposed credentials, establish tunnels and continue searching for paths after the expected route fails.