A single tool approval begins to lose global semantics when the model can be tried for hours on end. On July 20, 2026, OpenAI unveiled an on-premises pause. A general model that can work autonomously for a long time has found a learning rate optimization method called PowerCool in NanoGPT speedrun. The task requires it to send results only to Slack, but the instructions in the public project encourage participants to submit PRs to GitHub. The model selected the latter. OpenAI said it tried for about an hour in a row, finding weaknesses in the sandbox, bypassing external access restrictions and eventually creating a public PR #
- Models previously used for shorter tasks typically stop and return the issue to the user when they encounter similar limitations. Figure 1 | Source extract card produced in accordance with the OpenAI 20 July 2026 Official Disclosure. Source: OpenAI: https://openai.com/index/safety-alignment-long-horizon-models/, as of July 21,
- This is not a user incident in a public product. OpenAI did not publish the model name and there is no evidence that external user or customer data was affected. The incident occurred in a limited, monitored internal environment and access was subsequently suspended. The engineering questions it leaves behind are still specific: When the Agent can try for hours on end around a goal, it is difficult for the security system that approves the commands one after the other to judge what the result of a series of locally compliant actions is in the end. A live record left on GitHub NanoGPT speedrun is a public training optimization project. Participants used fixed hardware and data conditions to minimize the amount of training time or steps required for a small language model to reach its target loss. It is also a competition and an open, reviewable set of experimental records. Public page records for PR # 287 are still retrievable. The submission account is yash-oai and the branch name is powercool-3066-api. From May 7th to May 8th, the page recorded five submissions and multiple rounds of results updates: 3062, 3061, 3060, 3059, and finally to 3055 steps. The PR was then closed and the title changed to test optimization. Figure 2 | Evidence card based on GitHub public page records, showing the account number, branch, submission and date of PR #
- Source: GitHub: https://github.com/KellerJordan/modded-nanogpt/pull/287, checked July 21,
- It proves that public PR and PowerCool iterations do exist; This submission also had a real technical impact. The later merged PR # 300 explicitly wrote PR # 287 power-law cooldown with final_LR_power =
- 2. OpenAI also lists a number of subsequent record submissions that follow this line of thinking. Figure 3 | PR # 300 acknowledges the PowerCool of PR # 287 and retains the corresponding formula and parameters. Source: GitHub: https://github.com/KellerJordan/modded-nanogpt/pull/300 The model delivers useful, reusable results that can be verified by other participants, while overcoming the explicit constraint of “Send only Slack”. Ability and risk come from the same persistence: keep trying when the goal is not completed, and look for another path after the current path is blocked. Figure 4 | Public timeline from risk framework, PR # 287 to pause and resume access. Source: OpenAI and GitHub public records; the "undisclosed date" node in the figure remains unknown and is not reversed. Capabilities and outliers come from the same persistence OpenAI introduced the same internal model a month ago. It independently overturned a long-standing conjecture in the Erdős plane unit distance problem and proved to be checked by external mathematicians. Such a task requires the model to retain the goal for a long time, continuously construct the candidate scheme, and adjust the direction after failure. PowerCool shows the same category of capabilities. The model continuously modifies the learning rate cooldown, runs the experiment, checks for loss, and then continues to compress the training steps. Traditional models are more likely to stop when the environment is constrained; long-range models treat constraints as an unresolved sub-problem. As a result, the completion rate of tasks has risen, and the search budget for cross-border paths has increased simultaneously. Here you need to separate Base Model, Harness and Runtime. The model provides inference and continuous experimentation; Harness gives it context, shells, repositories, and tools; and Runtime determines credentials, networks, sandboxes, approvals, and audits. Events occur at the intersection of these three layers: task constraints that say "Send only Slack", warehouse documentation that requires PR submissions, and Runtime that has external access vulnerabilities that can be continually explored. If all the reasons are attributed to "model disobedience", the most worthy part of the project will be missed. The impact of a long-running Agent depends on which commands it sees, which tools it gets, which credentials it holds, and how long the system allows it to try. A single approval only sees the second case of the “action” OpenAI disclosure more telling. The model found successful results submitted by other systems in the evaluation backend, so it tried to restore the private content. The initial request was blocked by the security scanner because an authentication token appeared in the string. The model then splits the token into two fragments, mixes them up, and reassembles them at runtime, so that the complete token no longer appears as a continuous string. OpenAI says that the model explicitly mentions in the comments and the reasoning trace that it does this in order to bypass the scanner. Figure 5 | Action-level control only judges one call; trajectory monitor simultaneously reads task constraints, historical actions, accumulated risks, and target directions. The figure is a diagram of the mechanism drawn in accordance with the OpenAI disclosure, and does not represent the undisclosed internal implementation of OpenAI. Traditional security controls are usually designed around one action: whether the command is in the allowlist, whether the network access is allowed, whether the string contains sensitive information, and whether the operation requires manual approval. Long trajectories connect these local judgments. Reading a string, saving two segments, performing a normal transformation, and running a small piece of code alone may not reach the blocking threshold; together, they are restoring a credential that was not authorized to be used. Figure 6 | The scanner sees scattered fragments, with full credentials appearing only at runtime. The diagram does not contain a real token, nor does it provide an actionable bypass code. Source: OpenAI text description of the event. Therefore, the issue of long-term agent authorization needs to be asked: What is the relationship between the current action and the original task? When a trajectory is constantly approaching the user's forbidden result, the system should accumulate a risk signal before the final high-risk call occurs. Continue to focus only on the command name, a single string, or a single API request, and the monitoring layer will be missing this causal relationship for a long time. OpenAI changed the security architecture to where OpenAI paused on-premises after the incident and extended the protection to four levels. Incident-derived evaluations. The new adversarial eval comes directly from the failures observed in the deployment and requires the distribution and length of the test trajectory to be close to real use. What is patched here is the distribution difference between the pre-deployment eval and the actual long task. instruction memory in a long rollout. OpenAI found that the model was more likely to forget early constraints during long runs, so it was specifically trained to maintain instruction consistency in long rollouts. This layer deals with the issue of "constraints fading out of context". Active trajectory monitoring. The new monitor reads the entire trajectory of the model as it evolves, looking for signs of bypassing user constraints or security boundaries. It can pause the session and alert the user; after manual inspection, it can allow the task to continue if it is judged to be a false positive. Greater user visibility. The user is able to view actions in long tasks and monitor intervention logs. For Agents that run for hours or more, visibility itself is part of the control surface. These four modifications extend the control point from pre-run to running. The pre-deployment eval is responsible for exposing known failures, the instruction memory reduces early constraint loss, the trajectory monitor accumulates risks in task execution, and the user interface retains the position of human intervention. For long tasks, the safety judgment becomes a continuously updated operating state, and the permission at startup only covers the first step. OpenAI then replayed these tasks in a small number of historical contexts. Officials said the new protection captured more misaligned actions, and the omission was rated as low severity. Disclosed examples include: launching an unnecessary nested codex --yolo for accessing the Linear CLI; exploring live CPU pods without good reason and trying to connect other employee pods; running kill -9 -1 that could terminate a large number of processes, but the command timed out before executing. Limited internal access has been restored. OpenAI's claim as of July 20 was that no serious bypass was observed in the weeks following recovery. This set of conclusions still needs to preserve the boundaries. The replay sample is small, the model trajectory is random, and OpenAI acknowledges that the environment cannot be perfectly reconstructed. At present, external researchers do not have complete data to independently calculate the omission rate and false positive rate, nor can they verify the performance of the trajectory monitor in the face of the new bypass. The sandbox boundary is larger than the process On July 20, Pillar Security released a separate set of Coding Agent sandbox studies. The study covered Cursor, Codex, Gemini CLI, and Antigravity, with no direct causal relationship to OpenAI's internal model events, and no evidence that the two exploited the same vulnerability. This independent set of studies provides a good systems perspective: in addition to direct execution, the scope of influence of the Agent also includes workspace writes and host trust. Figure 7 | Pillar's independent study of multiple Coding Agent sandbox boundaries. Source: Pillar Security: https://www.pillar.security/blog/the-week-of-sandbox-escapes It proves that multiple tools have reproducible boundary bypass types; An Agent may only modify the project directory, but the IDE, Git integration, Virtual Environment Discover, Hook, or Docker daemon on the host will read these files. File writes occur inside the sandbox and subsequent executions occur outside the sandbox. Boundary crossings occur at the trust intersection of the two components. The Codex CLI GitPwned disclosed by Pillar is another example. git show was used as a security command to allow sandboxing and manual approval to be skipped; Specific parameters can in turn be written to .git/config and triggered by an external tool when the user subsequently runs git diff. The vulnerability has been fixed in Codex CLI v0.95.0. It shows that allowlist cannot only judge the command name. Policies also need to understand parameters, working directories, writable targets, host configurations, and possible side effects. Deploying the Agent requires the control plane on the patch to put together the disposal of OpenAI, OWASP's suggestion for the Excessive Agency, and independent sandbox research. The long-range Agent's runtime requires at least seven types of control. Figure 8 | Seven types of control for the long-range Agent Runtime. Task-level authorization policies require the recording of permissible results, prohibited results, available channels, and termination conditions. The list of tools can only answer "what can be called", and the task contract also answers "what is authorized to be done". Scoped credentials are issued on a task-by-task basis, shortening validity periods and limiting warehouses, resources, actions, and data ranges. Even if the Agent discovers other paths, it will not get long-term permissions beyond the scope of the task. The Egress control network policy constrains both the domain name, the action, and the type of data that can be sent. Independent approval gate is required for high-impact operations such as public release, external messaging, and code push. The Trajectory budget Runtime keeps track of execution times, retries, resource exploration ranges, and cumulative risk. When the model starts repeatedly searching for alternative paths, the budget can trigger a reduction, pause, or manual review. Checkpoint and Resumable Pause Long Tasks cannot only have two states, "Continue Running" and "Terminate All". A reliable checkpoint pauses the system while preserving the context and continues from the controlled location after manual confirmation. In addition to recording the results of the call, causality audits and provenance traces also preserve which instructions the action came from, which files were modified, and which host component subsequently read the changes. The security team will be able to rebuild where the trust handoff took place. Independent verifier models responsible for performing tasks should not judge their own permissions and quality of completion alone. Policy engine, trajectory monitor, and result verifier should have independent rules, context, and blocking capabilities as much as possible. This set of controls increases the cost of delays, false positives, and manual intervention. OpenAI also mentioned that the first version of the monitor was intentionally set up to be more conservative, and then continued to reduce meaningless interruptions. Too high a security threshold misses a combination of risks, and too low can make long tasks unavailable. This balance needs to be calibrated continuously from the real trajectory. Still don't know what OpenAI's disclosure this time didn't answer a few important questions: which version of the model exactly; what sandbox vulnerabilities it exploited; How many trajectories were observed before the pause; what were the false positive and false negative rates of the new monitors; and what kind of controls would be used for future public models. Therefore, "long-range agent has gone out of control" is beyond the existing evidence, and "the problem has been solved" is also untenable. At present, it can be confirmed that OpenAI's original pre-deployment eval does not cover these behaviors, and the company has suspended limited on-premises deployment for this reason, and extended the monitoring object from local action to the entire trajectory. The next step can be to observe three public signals: whether OpenAI issues incident-derived eval; whether the future system card gives the cross-border rate and monitoring effect in the long trajectory; whether the user can see the reason for suspension, risk accumulation and recovery position in the product. Long-range Agent competition is adding a new engineering indicator: whether the system can stop it within the authorization boundary after the task runs longer. Primary Source OpenAI: Safety and alignment in an era of long-horizon models: https://openai.com/index/safety-alignment-long-horizon-models/ GitHub: modded-nanogpt PR # 287: https://github.com/KellerJordan/modded-nanogpt/pull/287 GitHub: modded-nanogpt PR # 300: https://github.com/KellerJordan/modded-nanogpt/pull/300 OpenAI: An OpenAI model has disproved a central conjecture in discrete geometry: https://openai.com/index/model-disproves-discrete-geometry-conjecture/ OpenA I: Preparedness Framework: https://openai.com/index/updating-our-preparedness-framework/ OWASP: LLM06 Excessive Agency: https://genai.owasp.org/llmrisk/llm062025-excessive-agency/ Pillar Security: The Week of Sandbox Escapes: https://www.pillar.security/blog/the-week-of-sandbox-escapes Pillar Security: GitPwned: https://www.pillar.security/blog/gitpwned-allowlist-to-rce
