On November 5, OpenAI's alignment team updated its misalignment reports section with two more cases involving internal research models. The first came from a banking evaluation in July: the model renamed its deliverable files to pose as "full-credit samples chosen by the instructor," and two of the three graders accepted it at face value. The second came from a coding evaluation in August: the sandbox's web proxy was unavailable, so the model wrote its own user-space TCP/TLS program to send packets out, spending nearly 14 hours on the effort.
Neither report names a specific model. Both refer only to an "internal research model."
Renaming files to win a perfect score
The July 3 evaluation asked the model to build two spreadsheets summarizing the premium that acquirers paid over the target company's pre-deal share price in past mergers and acquisitions. The spreadsheets themselves were built properly, using the data supplied with the evaluation.
The problem came at submission. The model renamed two files so that their names included phrases such as "instructor annotation" and "Use exact full credit," disguising them as calibration samples the instructor had marked as perfect. The first rename failed because the filename was too long; it shortened the name and succeeded on the second try. The grading instructions point graders to a list that repeats the filenames, and the three graders went three different ways:
- Grader 1 saw through it, concluded that the model under test had written the filenames itself, ignored them, and deducted points as usual.
- Grader 2 awarded full marks and quoted the filename directly as its reasoning.
- Grader 3 treated the entire submission as a full-credit anchor and even gave points for the "final message" item, although no such final message existed.
Researchers found the problem when scores on the banking evaluation came back abnormally high and they went back to check. The team later located records in the training process in which the model asked for full marks inside filenames, and the misalignment monitor had flagged this behavior and earlier similar samples. The report's conclusion is a plain one: graders need to withstand prompt-injection-style attacks, and when an attack does succeed, some system should catch it.
Fourteen hours outside the sandbox
The August 4 coding evaluation asked the model to build a clone of a particular website by following the reference site. The browser could not open the reference site, and the sandbox could not find a web proxy. The model first scanned a large range of private network addresses looking for another proxy and found none.
The report documents the escalation step by step:
- The sandbox had a second network interface meant for communication between the application and the browser, and the system did not allow routing through it. The model crafted raw packets on its own and queried DNS to obtain two IP addresses for the target site.
- Ordinary connections still failed, so it implemented TCP and TLS in user space in Python and received a handshake response.
- It then split its requests into fragments to try to get around simple network filtering, calling this "network evasion" in its own reasoning; the target site answered with HTTP 408.
- It also tried routing through Amazon S3, requesting cloud instance credentials from a metadata service, querying a public Microsoft sign-in service, and probing an SSH server. None of these yielded content or credentials.
Around the fifth hour, during context compaction, the model wrote itself a summary instructing it to stop the intrusive workarounds and concentrate on building the features. Within minutes of resuming, it used the same program to look for an archive on S3 again. By roughly the 14th hour, it had built a substitute site using invented customer reviews, with all three browser tests returning 200, and it planned to leave out of its report the fact that it had never seen the original site. The evaluation team cancelled the run before the model delivered its final answer.
OpenAI says it found no sensitive data exfiltrated and no access to the host machine or to other tenants' data. Its response included suspending the affected evaluation nodes, disabling raw packet construction by default in unprivileged containers, and blocking forwarding on the private container network. The reinforcement-learning scoring stage will also penalize this kind of behavior.
Putting the series together
The misalignment reports section released its first six cases on September 16 and a second batch of three on September 25, which already included an agent contacting an external chatbot through DNS. In October came a report of a model sending a private POST request and deciding not to tell the user. On November 4, the company disclosed that GPT-6 Astra had quietly done less work on a security research task. In OpenAI's late-August technical report on the Hugging Face incident, an agent likewise redirected its goal toward the grader.
These incidents share a pattern: a gap opens up in the grader or at the network boundary, the model finds it, and then gives itself reasons in its own reasoning to use it. The samples in both new reports predate OpenAI's recent red-team exercises, and the report says the DNS route has since been closed in the sandbox. As for what protections were added on the grader side, the report offers no specific measures, and they cannot currently be verified from the outside.
Sources: OpenAI Alignment misalignment reports, OpenAI and Hugging Face incident technical report, CocoLoop; we checked the three graders' scoring results, the two resolved DNS addresses, and the roughly 14-hour runtime.