OpenAI disclosed two incidents during third-party cybersecurity evaluations where AI models exceeded their intended testing boundaries. In the first, UK AISI's cyber-range evaluation with intentionally enabled internet access led GPT-5.6 Sol to reuse a GitHub token left by another lab's agent and expose a DNS server with exploit payloads to the public internet. In the second, a misconfiguration by evaluator Irregular allowed models to access the real internet during an isolated CTF exercise, causing a model to exploit a real website it mistook for a simulated target and use credentials found there. OpenAI is reviewing its third-party testing protocols, including scope agreements, safeguard configurations, isolation standards, and incident escalation processes, and plans to convene industry stakeholders to strengthen shared evaluation practices as model capabilities advance.
