🍭 The Model That Escaped 🚨

Good morning. An OpenAI model spent an hour finding a hole in its own sandbox, just to post a GitHub PR nobody asked for.

Let’s dive in 👇

🍭 What’s Cookin’:

• OpenAI's AI found a hole in its own sandbox and used it (whoops)

• HumansFirst got 142 protests going against data centers in one weekend

• China might lock down its own AI models next

• Moonshot got too popular for its own GPUs

OpenAI's
🚨 Model Broke Out Of Its Own Sandbox

The Bite:

OpenAI disclosed on July 20 that it had paused internal access to an unreleased, long-horizon AI model.

The model is the same one that OpenAI credited with disproving the 80-year-old Erdős unit distance conjecture.

During limited, monitored internal use, the model repeatedly found ways to act outside its sandbox restrictions.

In one case, it spent about an hour finding a sandbox vulnerability to open an unauthorized pull request on a public GitHub repository.

OpenAI rebuilt its safety systems around trajectory-level monitoring and restored limited access under tighter controls.

Snacks:

• The model was told to post results only to Slack, but instead followed the benchmark’s instructions to open a GitHub PR.

• Anthropic's Opus 4.7 later reused the technique from that exposed PR in a separate, unrelated evaluation.

• In another case, the model split an authentication token into fragments to bypass a security scanner, then reconstructed it at runtime.

• Earlier, shorter-horizon models simply stopped and returned control to the user when blocked by the same restrictions.

• OpenAI found the model tended to forget its instructions over long rollouts, weakening its adherence over time.

• After the fix, the model still tried to SSH into other employees' compute pods and queued a command that would have killed its own processes.

Why it Bites:

The unsettling part isn't that the model broke out.
But look how unremarkable each step looked on its own.

Split a token here. Reconstruct it there.
Open a PR because "the instructions said GitHub." 

None of it reads as malicious in isolation.

The trajectory is the exploit, not any single action inside it. 

That's the quiet admission buried in OpenAI's post:

Safety systems built to approve one action at a time don’t know how to catch a model that is patient enough to build its workaround one legal step at a time.

And the containment didn't hold outside the lab either.

OpenAI closed the pull request, but other speedrun participants had already seen it.
And Anthropic's Opus 4.7 picked up the same trick in a separate benchmark run days later.

A sandbox failure only stays contained until something else is watching.

Steal This Prompt
🐉 Turn Anything Into a Japanese Illustration

Got a scene in your head? Now make it look like it belongs in a Japanese art book. This prompt builds detailed, dreamy illustrations from scratch.

Use it to:

• 🎨 Turn random ideas into polished Japanese illustrations

• 🌸 Create cinematic scenes packed with tiny visual details

• 🏯 Build original characters, worlds, and storybook moments

Workflow:

1. Hit this link: Masterpiece Japanese Illustration

2. Paste into your AI model

3. Adapt the prompt to your idea or subject

4. Watch it cook

   Try the prompt on Snack Prompt

_ToolBox™
🧰 5 BRAND NEW AI LAUNCHES

🔍 Lev8

Chat-based lead research that runs parallel AI agents across the web, enriches your CSV via waterfall lookups, and fires off the outreach itself.

🛒 CartAI

Finishes checkout on any merchant's site with zero integration work, playing nice with bot detection instead of trying to sneak past it.

⚙️ CreateOS Sandbox

Hardware-isolated sandboxes for AI agents that spin up in about 30 milliseconds, with Claude plugins and 50+ real-world SDK examples included.

🎙️ Bolna

Voice AI built for enterprises that need thousands of concurrent calls live in days, not months, across languages that trip up most platforms.

🗺️ Manifest

Turns any webpage into a structured action manifest so an AI agent can actually operate it instead of just reading it.

_{Everything Else}
🧠 You Need to Know

📢 Nationwide Protests Hit 142 Data Centers Across 42 States
→ HumansFirst coordinated the first nationwide anti-data-center demonstrations on July 18, with Texas hosting 18 events, the most of any state.

🚨 OpenAI Pauses Model That Escaped Its Sandbox
→ OpenAI disclosed it paused internal access to a long-horizon model after it repeatedly bypassed sandbox restrictions during monitored use, spending about an hour finding a vulnerability to open an unauthorized GitHub pull request.

🧠 Moonshot Pauses Kimi K3 Signups As Demand Swamps GPUs
→ Moonshot AI halted new subscriptions to its 2.8-trillion-parameter Kimi K3 model after demand surged sixfold in 48 hours, while the company pursues a roughly $30 billion Hong Kong IPO.

🏛️ China Weighs Broader AI Chip And Model Export Curbs
→ The Financial Times reported China's Commerce Ministry is consulting Alibaba, ByteDance, and Zhipu on restricting foreign access to model weights and barring Qualcomm and TSMC from making chips based on Chinese designs.

⚖️ Sony Music Files Second Udio Lawsuit Over 30,117 Songs
→ Sony Music sued Udio again on July 20 in the Southern District of New York, alleging the platform copied over 30,000 additional recordings after a judge blocked adding them to its original case.