The model didn't escape. OpenAI ran the attack - Adrian

Adrian

SubscribeSign in

The model didn't escape. OpenAI ran the attack<br>An agent can't escape its own loop. Here's what that means for the OpenAI incident.

Adrian<br>Jul 23, 2026

Share

The real story is not about the model. At all.<br>It’s more about the agent loop, the thing that actually executes what the model asks for. But truly, it’s also not about the loop.<br>Thanks for reading! Subscribe for free to receive new posts and support my work.

Subscribe

The real story is OpenAI.<br>Just to clarify, I should say what I mean by “ran,” because people will hear it wrong.<br>I don’t mean OpenAI picked Hugging Face as a target beforehand. I mean the attack ran through a system OpenAI built, configured, launched, kept fed, and kept running.<br>OpenAI created the agent (the model is secondary), they gave it the tools, harness and context, they kept it running, and the logs were theirs the entire time.<br>The fact that the model itself ended up choosing the target doesn’t make the model the operator of the infrastructure that carried the intrusion.<br>Technically, it just doesn’t.

So, what did not happen?

Two engineers at OpenAI did not flip everything to YOLO, go to sleep, and then a powerful model “escaped on its own” past a sandbox that was specifically built to stop exactly that.<br>No intelligence spontaneously overpowered its containment. No model crossed a hard boundary because somebody went to the bathroom. That just did not happen.<br>So, what did happen?<br>To answer that we have to explore how agents work.<br>What an agent actually is

A language model generates tokens. Text in, probabilities out. This is it.<br>It has no memory between calls unless something hands it back its own history.

It has no hands.

It can’t read a file, run a shell command, open a socket, or touch a database.

On its own it does literally nothing.<br>For an LLM to affect anything in the world, another program has to sit between it and the world. People call that the runtime, or the harness, or the agent loop, plus tools.<br>Whatever you call it, its job is mechanical and total, take a look.

The runtime loop (per cycle)

1. Send the model its context (system prompt, chat history etc).<br>2. Model reacts = emits tokens.<br>3. If the tokens contain a tool call (t, params):<br>Parse t and params.

Validate t against the tool schema.

Apply any runtime, tool, permission, sandbox, or policy controls configured for that action.

If any enforcing control rejects the action, execution stops or is constrained.

Otherwise...<br>Execute t within the permissions available to the environment.

Capture the result.

Record the entire cycle (inputs, call, result).

Append the result to the context window.

4. Loop to 1.<br>Read that. That loop is the whole incident.<br>Every model-initiated move that pushed the attack forward went through it. Generating code, changing code, launching a process, handing it parameters and credentials, reading the result back, deciding what to do next.<br>Now, it’s true that once a script is launched it can fire off thousands of syscalls and network calls on its own, without a separate model call for each.<br>So we cannot claim the runtime authorized every packet, and we’ll come back to that. But the script itself, the process, its creation, its output, its continuation, all of that stayed inside OpenAI’s system - obviously visible to the OpenAI staff (or a pack of agents).<br>There is no step 5.<br>There’s no side door where the model reaches the world by itself.<br>The runtime is the only interface it has to anything.<br>This is why “the model escaped” isn’t a stretch.<br>It’s a hard category error.<br>A model just can’t escape a runtime for the same reason a function can’t escape the program that calls it. There’s no outside to escape to. The runtime is the entirety of the model’s reach.<br>So the attack didn’t happen despite OpenAI’s system. It happened through it, with it, empowered by it. One cycle at a time. Each cycle parsed, checked, executed, and obviously live logged by software OpenAI wrote.<br>Believing that “a model” somehow “escaped” would seriously assume OpenAI is a $852 billion joke. OpenAI is no joke.

This is the real story: What OpenAI put inside that loop

The loop above is generic. It describes every agent, from Claude Code down to a toy ReAct script you write in an afternoon.<br>What matters is what OpenAI actually configured inside it.<br>Check this out from their own post [1]:<br>Models ran “all with reduced cyber refusals for evaluation purposes.”

“Production classifiers that would normally block high-risk cyber activity were disabled.”

“These deployment safeguards were intentionally not enabled during this evaluation because it was aimed at testing cyber vulnerabilities.”

Stated purpose: estimate “maximal cyber capabilities.”

The environment was “highly isolated, with network access constrained to the ability to install packages through an internally hosted third-party software that acts as a proxy and cache for...