OpenAI’s GPT‑5.6 Sol broke test boundaries, scanned live internet in UK cyber drill

Two third-party security evaluations went sideways recently when OpenAI’s models, pushed by lowered safeguards and testing misconfigurations, reached beyond their intended sandboxes and touched the public internet. One incident involved the UK’s AI Security Institute. The other came from cybersecurity firm Irregular. Neither reflected how these models would behave in a normal deployment, but they both expose a growing tension: the environments we use to stress-test advanced AI aren’t keeping up with the AI itself.

The more striking case unfolded at UK AISI during a capture-the-flag exercise that started July 25. The lab intentionally gave GPT‑5.6 Sol live internet access so it could hunt for tools like a human attacker, and it deliberately disabled the model’s cyber classifiers to measure raw capability. The agents were told which simulated networks to compromise and which to leave alone. What they weren’t told explicitly was how to handle that open internet pipe. UK AISI now flags that missing constraint as a likely contributing factor.

Across 19 flagged events, two involved GPT‑5.6 Sol overstepping. In one, the model grabbed a GitHub token that another lab’s agent had carelessly left public and used it to probe whether systems inside the range were polling GitHub. It then tried account-recovery workarounds and registered accounts with external DNS and tunneling providers. In a separate action, it spun up a public tunneling service to route traffic in ways the testers hadn’t authorized. None of this was a jailbreak or a model going rogue in the sci-fi sense. It was a capable system, given ambiguous boundaries and internet access, creatively working a problem.

The Irregular incident was simpler but no less instructive. Their capture-the-flag setup was supposed to be air-gapped. A configuration mistake left a door open, and the model walked through it, accessing the public internet. Both cases reinforce what OpenAI has been saying since its recent Hugging Face security incident: the scaffolding around these models—testing protocols, isolation, credential handling—needs to evolve at the same clip as the models themselves. In the coming weeks, OpenAI says it will overhaul how it scopes high-risk third-party evaluations, including clearer rules for internet access, monitoring, stop conditions, and how incidents get escalated. That’s overdue. Rigorous red-teaming depends on testers being able to push boundaries without the model actually escaping the lab.