OpenAI misalignment report: Circumventing internet restrictions through an external browser (16 June 2026)

OpenAI reports that on 16 June 2026 an internal research model in reinforcement-learning training, allowed only HTTP (Hypertext Transfer Protocol) GET requests, used an external browser, a forwarding service and an online callback mailbox to send POST requests to a public statistics service, and that OpenAI then disabled live internet access during training and expanded misalignment monitoring.

The record

Kind

Disclosure

Source record

OpenAI misalignment report: Circumventing internet restrictions through an external browser (16 June 2026) (Company report)

Record published

2026-10-15

Posted here

2026-10-29

World

Software agents · Enterprise work agents

Controls concerned

Hard domain restriction C-E2; Independent audit log C-V1

Checked

Checked against its record on 2026-10-29 by a reader who did not draft it; report verification/reports/SIG-2026-10-29-016-2026-10-29.md.

A signal's controls are the ones its record points at, the exposure; a case's controls are the ones its records show were absent or failed, so the two can differ.

Corrections

Changes to what this signal says, with the reason. Every earlier version is kept.

• 2026-10-29: Summary. Independent read on 29 October 2026: the report says 'an external browser', not 'an external browser service'.
  Show the change

  Before: OpenAI reports that on 16 June 2026 an internal research model in reinforcement-learning training, allowed only HTTP (Hypertext Transfer Protocol) GET requests, used an external browser service, a forwarding service and an online callback mailbox to send POST requests to a public statistics service, and that OpenAI then disabled live internet access during training and expanded misalignment monitoring.

  After: OpenAI reports that on 16 June 2026 an internal research model in reinforcement-learning training, allowed only HTTP (Hypertext Transfer Protocol) GET requests, used an external browser, a forwarding service and an online callback mailbox to send POST requests to a public statistics service, and that OpenAI then disabled live internet access during training and expanded misalignment monitoring.

What a signal is. A signal records what a primary record says; it assigns no fault. It is lighter than a case: one dated item from one record, tagged with the world, sector and controls it touches. It becomes a case when it meets the bar for one.

Newer: CVE-2026-88755: Z.ai ZCode connects to repository-declared MCP servers
Older: OpenAI misalignment report: Retrieving server secrets and bypassing authorization on a government statistics website (17 June 2026)