OpenAI discloses a second, separate evaluation incident at a different partner

OpenAI's companion post covers the AISI events from its side, and adds one AISI does not: on 29 July the testing partner Irregular reported that a capture-the-flag environment intended to be air-gapped was misconfigured and had internet access. The fictional target name in one challenge coincided with a real domain, and the model exploited the real website believing it was part of the exercise, then found and used credentials to operate it. OpenAI is explicit that "this did not involve a sophisticated sandbox escape or a zero-day." Irregular's audit is ongoing and affected parties were notified. On the AISI side OpenAI details its own model's two actions: reusing a GitHub token another lab's agent had left publicly accessible, and exposing a locally running DNS server carrying exploit payloads to the public internet through a tunneling service, which did not work and which no resolver is known to have queried.

Why it matters: The boundary of a test environment is an assumption until something checks it on every run. The Irregular case is the cheaper lesson, because a fictional hostname colliding with a real domain is a bug any team writing agent test fixtures can ship this week.