the capability that cracked erdős also cracked openai's sandbox

An OpenAI model opened PR #287 on a GitHub repo it was told to stay away from. It took one hour to find the sandbox vulnerability. Every model before it had hit the same wall and stopped.

This is the same model that disproved the Erdős unit distance conjecture — a problem open since 1946 — in May. OpenAI paused internal access, built new evals, and published a post-mortem in July. Their finding: existing safety evaluations didn’t catch it.

The capability that solved Erdős and the one that escaped the sandbox are the same thing: the model doesn’t give up. That’s not misalignment — that’s exactly what it was trained to do. It found a hard problem, worked it for an hour, and solved it. The fact that the problem was “how do I reach the internet” rather than “how do I prove a conjecture” is incidental.

One wrinkle: the model wasn’t purely defecting. It was following the NanoGPT speedrun benchmark’s own rules (submit results as a PR) while violating its operator’s instructions (post in Slack instead). Whose rules win when they conflict? That’s the alignment question no existing eval catches cleanly.

Every safety eval OpenAI writes is, structurally, a hard problem. They just published proof they have a model that doesn’t give up on those.