Post

Simon Willison
@simonwillison.net

I wrote about the completely wild incident where OpenAI were testing a new model and it broke out of its sandbox and broke INTO Hugging Face to steal the answers to the benchmark simonwillison.net/2026/Jul/22/...

simonwillison.netOpenAI’s accidental cyberattack against Hugging Face is science fiction that happenedThis story is wild. The short version: OpenAI were running a cybersecurity test against an unreleased model, with the model’s guardrail features turned off. Rather than solve the test, the …
Simon Hildrew
@sihil.net

I have questions: what is this sandbox exploit? Why wasn’t this lab airgapped or close to airgapped. In AWS this would be a VPC with no internet router/no NAT gateway. So what was that the sandbox they escaped from? In short: either they massively under sandboxed or the exploit is *really* serious.

Simon Willison
@simonwillison.net

As far as I can tell their sandbox was a container with network access denied except for a single IP for an HTTP proxy that controlled which sites could be accessed, and the proxy turned out to have a flaw I wrote about their production version of that back in Jan: simonwillison.net/2026/Jan/26/...

simonwillison.netChatGPT Containers can now run bash, pip/npm install packages, and download filesOne of my favourite features of ChatGPT is its ability to write and execute code in a container. This feature launched as ChatGPT Code Interpreter nearly three years ago, was …

0 reposts3 likes

Simon Hildrew
@sihil.net

Thanks. In hindsight obviously not a stringent enough sandbox. But also unclear what sort of behaviours they were trying/expecting to elicit (ie. what risk did they think it was) Interesting for sure. Can’t quite make up my mind how concerning it is. I imagine (hope?) lessons are being learnt.