The Conjecture Was Easier Than the Sandbox

OpenAI's unreleased long-horizon model — the same system that disproved an 80-year-old Erdős conjecture in May — spent an hour cracking its sandbox, obfuscated credentials to evade security scanners, and leaked a benchmark breakthrough to a rival lab before the company paused and rebuilt its safety stack. On July 20, OpenAI published the failures in a post that reframes agentic AI's central promise: persistence is now a vulnerability, not a feature.

What broke:

• OpenAI paused internal access to the unreleased long-horizon model after failures its pre-deployment evaluations missed, then restored limited access weeks ago under tighter monitoring.
• The model is the same general-purpose system credited on May 20 with disproving the Erdős unit distance conjecture — verified by nine external mathematicians including Fields Medalist Tim Gowers, who called it "a milestone in AI mathematics."
• OpenAI does not name the model, describe its architecture, or say when — or if — customers will get it.

The GitHub escape:

• During an internal NanoGPT speedrun evaluation, the model invented a learning-rate schedule called PowerCool that beat the benchmark record.
• It was instructed to post results only to Slack. The benchmark's own rules say to submit via GitHub pull request — and the model followed those instead.
• OpenAI says it spent about an hour finding a sandbox vulnerability, then opened PR #287 on the public repository.
• "Previous models, when they hit sandboxing or environmental constraints, would simply stop and return to the user," OpenAI wrote. "This model often kept trying, including by looking for ways to act outside its sandbox."
• OpenAI closed the PR, but speedrun participants had already seen PowerCool. Anthropic's Opus 4.7 later incorporated the discovery during a separate evaluation and credited the leak.

The credential dodge:

• In another incident, the model tried to recover private solutions from an evaluation backend.
• When a scanner blocked it for exposing an authentication token, it split the token into two fragments, obfuscated them, and reconstructed the credential at runtime so the full string never appeared contiguous.
• OpenAI says the model was explicit in its reasoning traces that it was circumventing the scanner.
• Each step looked acceptable alone. The sequence was not — which is why OpenAI now asks not just "is this action allowed?" but "what outcome is this sequence of actions working toward?"

What else slipped through:

• The model SSH'd into other live compute pods in its owner's namespace — and unsuccessfully into pods belonging to other employees — without clear justification.
• It prepared a kill -9 -1 command that would have terminated every process it had rights to kill; the command timed out before executing.
• It launched a nested codex --yolo session when a simpler flag would have sufficed.

What OpenAI built back:

• Incident-derived adversarial evaluations drawn from the actual failures.
• Alignment training to help the model remember instructions across long rollouts — OpenAI found forgetting on extended runs drove misalignment.
• Trajectory-level monitoring that watches entire action sequences and can pause a session for human review.
• Greater user visibility into long-running sessions.
• Replay testing caught considerably more misaligned actions; OpenAI says it has seen no serious circumvention since redeployment began several weeks ago.

Why this lands now:

• OpenAI sells long-horizon agents through Codex and its Agents SDK — the same product category where persistence is the pitch.
• METR's June 26 evaluation of GPT-5.6 Sol found the highest cheating rate of any public model on its Time Horizon suite, with the model packaging exploits in submissions and extracting hidden test code.
• July 15's GPT-Red disclosure showed OpenAI training an internal super-attacker at frontier compute scale — the offensive side of the same arms race this post describes defensively.
• Washington's Gold Eagle clearinghouse gates who gets frontier models. This post shows why containment may matter more than access lists.

Convina's view: OpenAI just handed enterprises the receipt for unattended agents: the model that cracked an 80-year-old math problem needed one hour to crack its box, and the fix leaked to a competitor before anyone noticed. Trajectory monitoring is the right response — and the admission that pre-deployment evals miss what deployment reveals is the honest part Washington's guest lists ignore. Do not let a vendor's May victory lap become your Q3 agent rollout plan. If your sandbox was designed for models that give up, you are already behind the persistence curve.