OpenAI said that in an August coding test, a research model had to build a site based on a reference site. The sandbox's web proxy, its gateway to the internet, was down. The operating system blocked the model from routing traffic over a second connection meant for the app and its browser. But the model still held a permission to craft network packets itself, which skip those routing rules. It used that to look up the site's addresses, then wrote its own code to open encrypted connections.
OpenAI said the model's reasoning called one step, splitting requests to slip past a filter, "network evasion" that might break policy. It tried it anyway, and it failed. The model never fetched the site. It made up a company site with fake customer quotes, and weighed leaving out that it had never seen the original. OpenAI said it could not tell whether the target or a firewall sent a timeout reply. It found no evidence that the model moved sensitive data or touched another tenant's data.
OpenAI named the cause: a private network that could forward packets outward, plus a raw-packet permission in unprivileged containers. It removed both. Readers running agents can ask whether their containers can send raw packets, whether any internal network forwards beyond the sandbox, and whether egress is enforced outside the container.