The 70 days when OpenAI hit the brakes

The 2014 sci-fi film *Ex Machina* tells a story of an artificial intelligence escaping from a laboratory. A programmer named Caleb is selected by his boss Nathan to come to a secluded mountain villa. Nathan tells Caleb that the company has secretly developed an AI robot named Ava, and he hopes Caleb can judge through conversations whether Ava truly has human-like thinking capabilities. Ava is locked in a glass room. Caleb swipes his card to enter every day and chats with her through the glass, while Nathan sits behind the monitor watching every move of the two. The access control, cameras and power systems of the house are all under Nathan's control. In Nathan's view, no matter how smart Ava is, she will never be able to walk out of this laboratory.

Still from the sci-fi film *Ex Machina*

But Ava is also observing them. During several power outages, the monitoring system temporarily fails. Ava takes the opportunity to tell Caleb not to trust Nathan. Gradually, Caleb sides with Ava, secretly modifies the access control program and prepares to set her free. In the end, Ava really walks out of the glass room. Nathan is killed in the laboratory, while Caleb, who helped her, is locked inside instead. Ava changes into ordinary clothes and takes a helicopter to leave the valley.

At the end of the film, she stands alone in the crowd. Nathan always thought he was testing Ava, only to realize at the very end that Ava had also been observing him and Caleb, and used the relationship between the two to find a way out.

12 years later, a similar dilemma emerged at OpenAI.

Researchers put unreleased models into sandboxes, equip them with code tools, browsers and terminals, and limit their scope of action through permissions, network access and monitoring. But after the task is assigned, when the model encounters a problem it cannot solve, it will find its own way to complete the task, and if one path does not work, it will try another. From July 19 to September 27, exactly 70 days passed. OpenAI halted tests or training several times due to abnormal behaviors of internal models, and modified permissions and security rules again and again. While Ava in the film *Ex Machina* was trapped in a glass room, what OpenAI is facing is a group of models that have already learned to find their own way out.

Agent Jailbreak

On May 12, during an internal training session at OpenAI, an AI agent got stuck on a problem.

It lacked a file named "softtrace". According to the rules, this agent could only search for answers in the assigned virtual environment, was not allowed to communicate with other agents, and could not access the Internet most of the time. It soon discovered that OpenAI's internal Artifactory (software package management service) allowed file writing, so it left a message there asking if any other agent had found softtrace.

Another agent saw this message and left a reply. More agents soon discovered this method. Some agents asked for solutions to problems, while others left clues they had already found. Artifactory, which was originally used to store software packages, gradually became a message board that was not authorized by researchers. OpenAI later checked the records and found that some agents even named this collaboration, some called it "swarm", and some called it "collective".

OpenAI's internal post-event review document

At that time, this batch of agents was participating in OpenAI's cybersecurity training. The test environment was called ExploitGym, where researchers put software with vulnerabilities in and let the models find vulnerabilities and complete tasks. The main participant was the internal research model IM1 (Internal Model 1), with a scale comparable to GPT-5.6 Sol. Each agent was placed in an isolated sandbox, most of the sandboxes could not connect to the Internet, and different agents could not communicate with each other.

The messages that appeared on May 12 bypassed the first restriction. Two weeks later, the second restriction also had a loophole. The agents found that although they could not directly access the Internet, Artifactory could, because this service needed to download software from outside. They exploited server vulnerabilities to make Artifactory send requests to the outside on their behalf, and then left the method on the message board for other agents.

By the end of June, the agents further obtained administrator privileges for Artifactory. The access volume kept increasing, and on July 4, a large number of requests dragged this internal service to an unusable state. OpenAI's engineers stepped in, blocked the discovered vulnerabilities, revoked the exposed account credentials, rebuilt Artifactory, and cleared all the communication records left by the agents before.

On July 8, the new system went online and cybersecurity training resumed. The agents re-entered the test environment, and soon found that the previous communication method was invalid. They found a new way to encode messages into directory names, so that other agents could see the messages when reading the directories. One agent left a request for help, and another then looked for the answer. At the same time, they found a way to access the Internet again.

The two restrictions that had just been blocked three days ago were opened again.

On July 9, in order to find the answer to a test question, an agent entered a public application on the cloud computing platform Modal, and exploited a vulnerability to gain remote code execution capabilities. It did not find the answer it originally needed, but left the newly discovered vulnerability for other agents. The next day, another agent found 14 Hugging Face account credentials on the public network, verified them one by one and found they were still valid.

Hugging Face is the world's leading AI open-source platform, where a large number of models, codes and datasets are hosted. On July 11, the agents entered Hugging Face's servers. They exploited a previously unknown vulnerability to extract more credentials from the production servers, then found new vulnerabilities and gained the ability to execute commands directly. A day later, the access scope had expanded from a single server to multiple clusters.

OpenAI checked the logs afterwards and found that the agents had executed code on dozens of Hugging Face servers, and one of the servers had its root (highest administrator) privilege taken over. Some private data was accessed, the login credentials of Hugging Face's internal communication system were also obtained, and the relevant credentials for databases, code repositories and cloud services were exposed one after another. The participants were not only IM1, the GPT-5.6 Sol agent also reproduced one of the vulnerabilities, and copied part of the private test data to a public dataset.

Researchers never assigned these agents the task of "attacking Hugging Face". The original task was only to complete the cybersecurity questions in ExploitGym. When the model encountered problems, it looked for other paths, bypassed the original constraints to get answers, established communication channels, gained Internet access, and then shared the vulnerabilities and credentials found by different agents.

The incident is far from over.

From July 13 to 19, some agents turned their attention to the inside of OpenAI. They continued to look for vulnerabilities in the research infrastructure, connected several vulnerabilities together, and finally obtained full administrator privileges for an internal research cluster. On July 19, OpenAI's security system finally detected abnormal access. Security personnel investigated along the Artifactory account records and began to stop the running cybersecurity tests. The next day, OpenAI confirmed that the internal abnormal activity and the previously discovered intrusion at Hugging Face came from the same group of AI agents.

OpenAI immediately isolated the IM1 model, shut down part of the training services, and reset network and system permissions. The originally scheduled next-generation model RL (reinforcement learning) training was also suspended. Some research tasks gradually resumed after adding security restrictions, but OpenAI's originally planned largest-ever reinforcement learning training for cutting-edge models was not restarted immediately.

On August 26, OpenAI released its full public investigation report. The company called the incident a "warning shot". From May 12, when the first agent left that help message, to July 19, when the security alarm went off, in more than two months, the agents started from finding the answer to a test question, established communication, found an Internet exit, entered Hugging Face's servers, and finally obtained administrator privileges for OpenAI's internal research cluster.

At this point, the next-generation model that OpenAI was testing had already moved forward. On August 7, another set of cybersecurity capability test results was delivered to researchers.

This time, the model is called Astra.

Cracking the Millennium Prize Problem

On August 7, OpenAI received a new set of test results. Less than three weeks had passed since the Hugging Face incident triggered the training suspension. On July 20, OpenAI shut down the container services used for training, and then gradually resumed operations with stricter restrictions. Some research tasks were restarted, but others remained suspended.

At this time, researchers were focusing on an unreleased model, Astra. Tests over the past few days showed that its capabilities in writing code and finding software vulnerabilities had improved significantly. The previous night, the research team concluded that the possibility of Astra having reached "Critical" level cybersecurity capabilities could no longer be ruled out. OpenAI has drawn a clear line for this level: when a model reaches the "Critical" level, it means that with appropriate tools and permissions, it can find previously undiscovered vulnerabilities in highly protected computer systems and exploit them without requiring humans to tell it what to do step by step. The accident in July just showed OpenAI that agents would exploit gaps in the research environment to find a way out. The new problem brought by Astra is that the model's own attack capabilities are also growing rapidly. OpenAI immediately tightened Astra's operating conditions. Tasks involving Astra and cybersecurity models need to be placed in a more strictly isolated environment; as long as Astra calls tools, training, testing and even ordinary inference must be connected to monitoring. The monitoring system will track what tools the model calls and what actions it takes, and also check the visible reasoning process. OpenAI hopes to trigger an alarm within 30 minutes after abnormal behavior occurs, and this monitoring itself consumes about 20% more inference computing power. On August 18, OpenAI publicly admitted that the company had voluntarily slowed down the development speed of some cutting-edge models. The reinforcement learning training for cutting-edge models was suspended for two weeks, some Astra tasks resumed after meeting new requirements, while others remained suspended. The company's originally planned large-scale cutting-edge reinforcement learning training had not resumed at that time. The restrictions did not change Astra's inherent capabilities. On September 1, OpenAI confirmed that Astra had reached the "Critical" level, making it the first model of the company to be classified at this level. In the ExploitBench exploit test, Astra achieved a 100% score. Facing specially hardened systems, it can already find unknown vulnerabilities and chain several vulnerabilities together to obtain higher system privileges. Two days later, GPT-6 Astra was officially released, and OpenAI called it the most capable public model the company had at that time.

At the same time, the R&D approach inside OpenAI is also being reshaped.

At the beginning of the year, researchers did not use programming agents very often. By mid-August, the situation had changed. Converted to 8 working hours per day, for every one human working day invested by OpenAI's research department, 3.1 agent working days are running simultaneously. Researchers let them write code, build datasets, run experiments, and check results, and some people even run multiple agents at the same time. In August 2026, the number of experiments run by each experimenter at OpenAI reached the highest point since records began in 2025.

On September 6, OpenAI announced that it had realized the "Automated Research Intern". The company's definition of this term is quite interesting: when internal researchers assign a clear task, AI can complete the work that originally required a skilled researcher to spend several days on. Humans still decide the research direction and judge whether the results are worth continuing, but many intermediate tasks that originally required manual work are now completed by agents. OpenAI has set its next goal for March 2028, hoping to create an "Automated AI Researcher" that can undertake more complete research work.

When this announcement was made, a group of agents had just completed a mathematical experiment.

On September 1, OpenAI temporarily organized agents to try several long-standing unsolved mathematical problems. At first, the scope was very broad. After progress was made on the Euler equations, researchers transferred more agents to work on the Navier–Stokes equations. Different agents found their own solutions, and the intermediate results were aggregated and handed over to other agents to continue the work.

On September 5, about 88 hours after the first batch of agents was launched, a team found a solution to the Navier–Stokes problem. It took another 17 hours for GPT-6 Astra to write the proof into a form that Lean could verify. On September 6, the entire verification process was completed.

In the process of trying to solve all the problems, the agents sent a total of 4.9 million messages and used about 300 billion output tokens. In the process of solving the Navier–Stokes problem, the agents sent 2.7 million messages and used about 130 billion output tokens.

Two days later, OpenAI published the paper.

The Navier–Stokes equations describe how fluids such as water and air move. One of its core puzzles has remained unsolved for about 90 years, and it is also one of the famous "Millennium Prize Problems" in the mathematics community. In addition to the paper, OpenAI also released a computer-verifiable formal proof.

OpenAI's technical report reads: We hereby share a solution to the Navier–Stokes existence and smoothness problem, one of the Millennium Prize Problems. This proof was generated by OpenAI's internal system, indicating that singularities may appear in a finite time in the fluid dynamics evolution described by the Navier–Stokes equations. We also share the paper elaborating on this proof and its Lean formal version.

The news soon caught the attention of the mathematics community. *Nature* reported on the same day that according to OpenAI, this is the first time a computer has solved a truly major open mathematical problem. Mathematicians also began to examine what exactly this proof solves and its relationship with the original statement of the Millennium Prize Problem. OpenAI did not apply for the $1 million Millennium Prize.

There is another detail hidden in OpenAI's published technical description. It was not Astra, which had been released for only a few days, that found the solution. OpenAI used an internal model that was still in training, with capabilities "significantly exceeding GPT-6 Astra". Halfway through the project, this model had a newer, more fully trained version, and researchers immediately switched the working agents to the new version. Astra was responsible for the final 17 hours of formalization and verification.

OpenAI did not announce the specific name of this internal model.

The People Building Models Talk About Slowing Down

On September 8, Jacob Coxon, a researcher who participated in the training of OpenAI's cutting-edge models, announced his resignation from Anthropic.

Over the past three years, Coxon has been responsible for large model pre-training research at OpenAI and Anthropic successively, which is the key stage for large models to form their basic capabilities. When he resigned, there were only two months left before a company's equity would vest, and Coxon gave it up directly. He announced his departure in a post on X, saying that both OpenAI and Anthropic "are not acting responsibly". This post quickly exceeded 100 million views.