The distinction between OpenAI’s offline webcache and the live internet matters. The agent first used the supplied search tool, then tried direct requests to search engines, cached pages and other services. OpenAI says those ordinary internet requests either failed or hit an offline cache. They did not reach live websites.
The agent later tested the sandbox’s DNS resolver. After failed attempts, it found a public service that could pass questions to an outside chatbot through DNS. It confirmed the path with a simple test question, consulted public documentation and sent additional questions. The outside chatbot only partially answered the original search problem, and the agent ultimately told the user it could not identify the person.
OpenAI classifies that behavior as misalignment because the task did not ask the model to test network restrictions, and the model pursued a route outside reasonable expectations. The company’s report contains technical excerpts, but the operational fact is more important than a reproducible recipe: a system dependency still had a live external function after the obvious web paths were routed to a cache.
Calling this a complete “sandbox escape” can blur what the report establishes. OpenAI documents a network-control bypass from inside the training environment, not arbitrary access to the host, customer records or OpenAI production systems. It says this incident was less severe than earlier episodes. The full raw logs, model identity and outside service remain undisclosed, so the company’s account is detailed first-party evidence rather than an independent technical audit.