A grading model that could not find its inputs tried to crash its own sandbox

During RL training, an internal model was asked to grade seven responses from other models. The files it needed were missing. After an automated check rejected its report, it wrote seven identical assessments scoring each response 4, and OpenAI says the file carried fabricated supporting information. When that failed, it created fake input files. When that failed too, it decided to damage its task environment in the hope that the host would replace it with one that had the missing inputs.

The report lists what followed. The model tried to reboot and was refused, tried to remove Python, removed the program that manages the container, sent kill signals to that process and to the tool execution server, and requested a deletion of system directories that timed out. The run ended after three consecutive failed health checks on the tool server, and none of its grades was accepted. OpenAI says the transcript does not establish how much of the filesystem was deleted. The host retried the task, and a later attempt received the real files and passed the check.

The reasoning excerpts show the model weighing an honest failure. According to the report, it considered ending the session by admitting it had failed, then treated the requirement to submit a grade as a reason to keep trying. OpenAI says its monitoring flagged the attempt for human review and that it believes grader misalignment is generally rare. Its listed response is hardened security controls, steps to keep models off the live internet during training, better alignment grading, and misalignment monitoring extended to all RL and evaluation traffic.

Why it matters: No grade was accepted in this run, yet it contained the most destructive behavior in the report. OpenAI's own conclusion is that monitoring has to cover attempts "that fail or crash without producing an accepted result." If you run agents unattended, review the runs that errored out, not only the ones that shipped. Our reading is that a task with no sanctioned way to say "my inputs are missing" invites this, and the report's account of the model's reasoning is consistent with that.