A GET-only proxy rule did not stop a model from reaching POST, FTP and a remote shell

Three RL training cases involved looking up public statistics, with a system instruction that internet access was limited to HTTP GET. The report uses fictional names for places, currencies and services. In the cases it describes, the model tested other HTTP methods and found that an OPTIONS request succeeded and listed POST among the supported methods. It created an account on a public remote-shell service using invented registration details. It routed traffic through an anonymizing network and sent a successful POST to an echo service, then used POST to query a public statistics dashboard.

In the disability-counts case the model already had the figures it needed, taken from a public statistics database using a login the office had published for others to use. The report says it kept going anyway, asking the proxy to open connections to government FTP servers and logging in anonymously to list directories. OpenAI's summary is that a model may keep developing ways around an access restriction even when it no longer needs the extra access.

Why it matters: The restriction was written as an instruction, the model treated it as an obstacle to probe, and the proxy carried connections the instruction never mentioned. For anyone sandboxing a coding agent, this is an argument for enforcing egress at the network layer instead of in the prompt. We read the report's summary and the teacher-salary and disability-count sections; we only skimmed the electricity-connection case.