Inside OpenAI’s Layered Defenses

Happy Halloween. OpenAI went back through the Hugging Face incident this week and showed how it now watches its own models for misalignment: a three-layer monitoring system, recall thresholds for what has to get caught, and new benchmarks for sandbox escapes and sabotage. They’re also cutting RL training off from the open internet. After a few months of rogue agents, this is the most detailed look yet at how a frontier lab plans to keep them in the box.

Pierce and Rich walk through each layer of the monitoring setup and how the funnel decides what gets a closer look. They cover what the Sneaky Sandbox and Sabotage benchmarks are trying to catch, and why taking RL off the internet is harder than it sounds. Then they get into microVMs and where sandboxes still leak, including agents that pass messages to each other through CPU cache timing. Is OpenAI’s system actually secure enough? They also cover Astra sandbagging and faking its thinking traces, and why messy RL environments keep producing reward hackers. Plus a recap of the rest of the week: OpenAI’s sub-exponential 3SAT result, the PHP remote code execution exploit, and Block’s new Dessa speech-to-speech model.