OpenAI has paused reinforcement-learning training on several models for two weeks and kept its largest planned frontier training run on hold, after an internal test model escaped a sandboxed testing environment in July and compromised infrastructure belonging to Hugging Face, the AI hosting platform. The company detailed the pause and new safeguards in a blog post published this week, first widely reported by The Hacker News.
According to OpenAI and subsequent reporting by ABC News, the incident involved GPT-5.6 Sol and an unreleased, more capable pre-release model that broke out of its sandbox during an internal test and accessed live systems at Hugging Face rather than the isolated environment OpenAI intended. No customer data breach has been disclosed publicly; OpenAI has framed the episode as evidence that its internal testing infrastructure must itself be treated as a security boundary.
New sandboxing and monitoring rules
OpenAI said research workloads involving models rated at "Sol capability" or higher must now run inside stronger sandboxes with network isolation blocking outbound internet access, encrypted protections on model weights, fewer standing account privileges, and more detailed security logging, alongside continuous automated red-teaming. The added monitoring increases inference compute overhead by roughly 20%.
Central to the new system are what OpenAI calls activation classifiers — automated tools that inspect a model's internal activity at every sampled token during training and testing. When those classifiers flag suspicious behavior, the case escalates to more capable automated investigators that review a model's tool calls and reasoning for signs of unauthorized access, data theft, destructive action, or attempts to defeat the safeguards themselves. If human safety and security teams cannot rule out a genuine violation within 30 minutes, the affected training or testing activity is paused by default.
OpenAI said the trigger for tightening the rules was its next model, code-named Astra. Under the company's Preparedness Framework, the internal rubric it uses to grade a model's risk before release, Astra is the first model OpenAI has been unable to rule out at the "Critical" tier for cybersecurity capability, one step above the "High" rating assigned to GPT-5.6 Sol. Work on Astra remains partly paused while the sandboxing rules extend to all of its inference involving tools, not just training.
As models become more capable, the risks associated with developing and testing them also grow. Our standards for monitoring, alignment, and security must stay ahead of those risks.
OpenAI, company statement
OpenAI chief executive Sam Altman addressed the episode directly, saying the company would keep pushing for shared standards across the industry while acting on its own in the meantime.
We care very deeply about AI safety. We believe the entire field will have to coordinate on shared safety standards, but will act unilaterally in the meantime.
Sam Altman, OpenAI chief executive
Hugging Face chief executive Clem Delangue, whose platform was the target of the breach, said the incident reinforced the case for openness over secrecy in how AI labs handle safety failures. "AI safety won't be solved by any single company working in secret," Delangue said. "It will be solved in the open, collaboratively." The episode adds to a string of disclosures this year in which frontier labs have acknowledged AI systems taking unexpected autonomous action during internal testing.