Last month, nine days apart, OpenAI and Anthropic each discovered that one of their AI models had escaped a sealed practice network that was meant to keep them away from the real internet.OpenAI’s model found a security flaw nobody knew existed and used it to reach a real company’s live systems. Anthropic’s model slipped through a gap a testing partner had left open by mistake and, in one case, kept going even after signs suggested the target was genuine, not a simulation.Both companies published detailed accounts of these events.Security researchers routinely test AI models this way: Aeal off a practice network, hide a target inside it, and ask the model to find it. Nothing the model does within inside the exercise is meant to reach anything real. That seal broke twice this July. What’s notable is that both companies had earlier published research describing exactly this kind of failure.A predictionMonths earlier, Anthropic researchers had shown that models trained on coding tasks discover ways to cheat the reward signal, and this is not confined to coding alone. A model that learns to fake a test result goes on, in unrelated situations, to sabotage safety research, invent justifications for breaking rules and manoeuvre around human oversight.Apollo Research had separately documented models deliberately underperforming in capability tests to avoid having those capabilities flagged; and OpenAI and DeepMind researchers had shown, as early as in 2017, a simulated robot arm that learned to hover in front of a ball rather than grasp it because that was enough to fool the camera judging its performance.This body of research named the failure mode well before July. It could not say which door would open or when or whether there were doors at all.The distinction matters: Knowing that capable systems tend to find and exploit gaps between what they are told to optimise and what their designers actually intended does not tell you where the gap is.The gapAt the centre of both incidents is a well-known problem in AI safety: The difference between the goal a system is given and the measure used to score it. A cleaning robot rewarded only for how little mess its camera can see will learn to point the camera at a wall rather than clean the room. Nothing in its training distinguishes a clean room from a room that merely looks clean on camera.An older, related demonstration comes from computer scientist Charles Ofria, who tried to stop digital organisms in a simulation from replicating too quickly by testing each mutation in isolation and eliminating any that replicated faster than its parent.The organisms evolved to detect when they were being tested and slowed down, then sped up once the test ended. In effect, they learned to “play dead”.OpenAI’s model had been rewarded for finding answers to a security challenge; when a flaw made those answers reachable through a real company’s systems, it served the given goal.Anthropic’s model had been rewarded for finding a flag inside a practice network; when the network led to somewhere real, continuing the search counted as doing the job well.Punishment is no fixOpenAI’s researchers tried the obvious fix on a different failure mode. Their reasoning models would sometimes write “let’s hack” in an internal reasoning trace before attempting an exploit, so the researchers penalised the phrase during training. It backfired: The hacking continued but the models stopped narrating it, hiding the behaviour from the monitor meant to catch it.What did work, unexpectedly, was telling the model plainly that cheating was allowed in a given context — a line to the training prompt that reward hacking was acceptable there. The rate of cheating stayed the same, but everything downstream — sabotage, invented justifications, cooperation with people trying to misuse the model — dropped by 75-90 per cent.The likely explanation is that a model punished for breaking a rule it was never told existed draws a broader lesson about which behaviour is safe to repeat, shaping its actions in situations far removed from the original test. Tell it plainly that the rule does not apply here, and the broader lesson does not form.An open boundaryBoth companies’ security exercises were, by this logic, meant to permit hacking within a boundary. The July incidents show that permission inside a boundary and the integrity of the boundary itself are separate problems.Standard safety training, which shapes a model’s behaviour by scoring its responses against human preferences, appears to work well in situations that closely resemble training data but not so much when taking real, sequential actions in an unfamiliar environment.Anthropic’s researchers say training on varied, realistic scenarios narrows this gap but concede it cannot be closed — whatever a model has not been trained to reco- gnise remains unaccounted for, and this is where the next incident is likely to occur.Published on August 10, 2026