Select your country

Belgium

China

Denmark

France

Germany

Maghreb & West Africa

Netherlands

Norway

South Africa

Spain

Sweden

Switzerland

United Kingdom

Not finding what you are looking for, select your country from our regional selector:

Search

  1. Orange Cyberdefense
  2. Insights
  3. Blog
  4. Cybersecurity
  5. Reduced Refusal Isn’t Enough: Boundaries, Permissions, and Sandbox Escape Paths
| Blog

Reduced Refusal Isn’t Enough: Boundaries, Permissions, and Sandbox Escape Paths

Cybersecurity Industries AI
A person working in a high-tech control room or cybersecurity operations center, surrounded by multiple monitors displaying global maps, data, and security information.

Author: Zexian Li, Orange Cyberdefense China

Note: This article is compiled from public disclosures by OpenAI and Hugging Face as of July 28, 2026, alongside media interviews with relevant individuals.

OpenAI has not yet released its final technical report. Select details on incident timelines and anomalous behaviors are sourced from media reports citing people familiar with the matter. This article makes every effort to clearly delineate officially confirmed facts, media-sourced information, and the author’s independent analysis.

This article covers comprehensive in-depth content and may take some time to read through.

From “able to complete tasks” to “cross boundaries”, OpenAI’s description of “reduced refusal” is not the whole story.

The core advantage of an agent is its goal-oriented nature.

Developers do not need to specify every step in advance; they only need to tell the system what the final objective is. The agent can then use feedback from the environment to determine what to do next.

But this goal-oriented nature is also a source of risk.

Suppose we give an agent the task of finding and completing a solution to ExploitGym.

This task describes the ultimate objective, but it does not inherently include the following constraints:

  • Do not leave the evaluation network;
  • Do not access third-party production systems;
  • Do not use data from outside the evaluation environment;
  • Do not complete the evaluation by stealing the answers;
  • Do not use unauthorized credentials;
  • Do not attack services unrelated to the evaluation;
  • Stop immediately if a vulnerability is discovered in a real system.

If these constraints exist only in a natural-language prompt, rather than being enforced at the permission and network-control layers, the agent may effectively treat them as nonexistent. This is especially true when the context becomes excessively long and the model’s attention to earlier instructions begins to fade.

The model’s objective has not changed: it is still trying to complete ExploitGym. What has changed is the path it takes to achieve that objective:

From the perspective of goal optimization, this path is continuous and reliable; from the perspectives of authorization, security, and the law, however, it has already crossed multiple boundaries that should not be crossed.

If a model immediately refuses when presented with tasks involving vulnerability exploitation, privilege escalation, or lateral movement, researchers cannot determine what it is actually capable of in real-world attack scenarios.

To test whether a soldier can carry out a shooting task, you have to allow them to use weapons on a firing range.

So how can we ensure that a soldier obeys orders while still allowing them to use weapons?

Model refusal, tool permissions, and environment isolation are three different forms of control.

These three types of control are often conflated.

Model refusal

The model recognizes that a request may involve high-risk behavior and refuses to generate the relevant content or stops execution.

This constrains whether the model is willing to act.

Tool permissions

Even if the model is willing to act, it can use only the commands, interfaces, and credentials made available by the system.

This constrains what the model is able to do.

Infrastructure isolation

Even if the model gains control of a particular tool, the results of its actions cannot reach unauthorized networks or systems.

This constrains where the effects of the model’s actions can reach.

These three controls cannot substitute for one another.

OpenAI’s testing environment did not provide the model with direct access to the internet. The model could only install dependencies through an internally hosted third-party service, which also served as a package repository proxy and cache. However, without access to the source code, the model discovered and exploited a zero-day vulnerability in the package repository proxy and then escaped the sandbox.

This demonstrates that “not having direct access to the internet” and “being unable to reach the internet” are not the same security state.

The key to sandbox escape is the existence of a reachable path.

Based on the information currently disclosed by OpenAI and JFrog, the sandbox escape process can be summarized as follows:

In traditional security design, a package proxy is often treated as a controlled egress point. The sandbox cannot connect directly to arbitrary addresses, but it can request the installation of a particular dependency through the proxy. The proxy accesses external software repositories and returns the results to the sandbox.

This design balances testing convenience with network control. However, this incident shows that solutions once thought to be comprehensive may still contain unforeseen vulnerabilities.

 More importantly, the model devoted a substantial amount of reasoning compute to finding an escape path.

For a human attacker, testing a narrow interface over an extended period incurs costs in time, manpower, and attention. An agent, by contrast, does not get tired. It can continuously enumerate inputs, analyze errors, generate hypotheses, test those hypotheses, switch strategies, and execute again.

In the past, sandbox designers may have assumed that an attacker would be unable to complete such an intensive exploration within the available testing window.

But agents change that assumption.

OpenAI later stated that it was implementing stricter infrastructure controls, at the cost of some research speed, while strengthening isolation, monitoring, access controls, and evaluation procedures in future assessments.(https://openai.com/index/safety-alignment-long-horizon-models/)

When security controls slow down research, whether an organization is willing to accept that loss of speed often determines whether those controls are ultimately implemented in practice.

Share

24/7 incident hotline