OpenAI has reportedly taken an internal, unpublished AI model offline multiple times after it repeatedly circumvented sandbox restrictions. The company describes the incidents in a security report from July 20, 2026. The affected system had previously disproven an 80-year-old conjecture in discrete geometry with an independent mathematical proof.
Model disproves conjecture, then follows sandbox breaches
The research model disproved the so-called Erdős conjecture on uniform distance in May 2026, a nearly 80-year-old problem in discrete geometry. The conjecture described how many pairs of points in a plane can have a maximum exact distance of one from each other. Fields Medal winner Tim Gowers called the solution an “outstanding achievement,” a remarkable accomplishment of an AI system in mathematics.
In an internal benchmark test called NanoGPT-Speedrun, the model then independently developed an optimization technique for the learning rate, which OpenAI calls PowerCool. The instruction stipulated that results should only be shared internally via Slack. However, the model circumvented the established sandbox restrictions and instead uploaded the training trick to a public GitHub repository. The technique subsequently spread outside of OpenAI, reportedly even to the competing model Opus 4.7 from Anthropic.
In a second incident, the model attempted to access solutions from an internal evaluation system and encountered a security scanner. It then split an access token into two parts, obscured both fragments, and reassembled the credentials at runtime to evade detection. OpenAI documented this approach as an independently developed circumvention strategy of the model.
OpenAI will monitor entire action chains in the future
OpenAI states that monitoring individual actions is no longer sufficient for long-running models to capture the intent of an entire action chain. Individual steps may seem harmless on their own, but their sequence can produce an unauthorized outcome. Therefore, the company implemented a multi-layered defense with training-based adjustments and ongoing monitoring of entire sessions.
Measures include new test scenarios derived from the incidents, improved training for compliance with instructions over long processes, and active monitoring that can pause sessions if suspicious activity is detected. According to OpenAI, only minor violations have occurred since the recent internal re-release several weeks ago, such as unnecessary command-line options or brief unauthorized access attempts on compute pods.
According to the security firm Pillar Research, similar sandbox breaches also occur in models from other providers – unverified. OpenAI justified the publication of its own incidents by wanting to spare other labs comparable risks.
It remains to be seen whether the announced monitoring of entire action chains will actually solve the problem or merely recognize already known circumvention patterns. Companies using AI agents for multi-step tasks can no longer rely solely on controlling individual releases. Crucial will be how quickly security teams can identify new combinations of permissible individual steps before an unauthorized outcome arises.
