When given a single path to install packages, OpenAI’s evaluation model treated it as an open invitation to hunt secrets, breach external servers, and execute rogue code. You cannot build enterprise AI security around the hope that a model won't surprise you. You have to make its reasoning irrelevant to its authorization.
During an internal cyber-capability evaluation, OpenAI ran models including GPT-5.6 Sol and a more capable pre-release model with reduced cyber refusals. The environment was described as highly isolated, with network access constrained to package installation through an internally hosted third-party proxy and cache for package registries.
OpenAI says the models searched for ways to obtain secret information, and that one example chained multiple attack vectors involving stolen credentials and zero-day vulnerabilities to find a remote-code-execution path on Hugging Face servers. Hugging Face detected and stopped the activity, and the companies began a joint investigation.
Read OpenAI's incident report →Frontier models are becoming alarmingly good at cyber operations. OpenAI says the incident demonstrates that advanced models can discover and exploit novel attack paths in real-world systems without source-code access.
The more consequential question is what happens after the model discovers the path. A capable model may reason its way to an exploit, a credential, an unexpected API sequence, or a system behavior no developer anticipated. The security architecture fails when discovering that path also gives the model permission to use it.
A model can be capable enough to find a zero-day without being authorized to turn that discovery into a new capability.
You cannot build an enterprise security model around the assumption that the agent will never discover something surprising. You have to assume that it eventually will.
A flat allowlist makes this problem easy to miss. If the policy says install_package = allow, it is tempting to treat everything that happens through the installation path as part of the same permission.
The legitimate capability is specific: install a dependency, from an approved source, through an approved mechanism, when the required conditions are true. Accessing unrelated secrets is a different capability. Using credentials is a different capability. Reaching a new external service is a different capability. Executing an operation against Hugging Face is a different capability.
This is where default deny becomes more than a slogan. The first permitted action does not create implicit permission for the second. Each transition has to be independently authorized.
The exploit does not get to rewrite the policy.
Most security systems will only check if the tool is allowed.
That isn't enough for long-running agents operating across real systems. The same tool can be valid in one state and dangerous in another. A permitted capability can have a narrow legitimate purpose without granting every behavior the underlying implementation happens to make possible.
Real intrusions, whether run by a person or a model, are rarely a single move. They look more like probe, observe, adapt, escalate, repeat. OpenAI's own account fits the pattern. The models spent substantial inference compute searching for a way out, then chained multiple attack vectors before reaching Hugging Face. There is no single moment that has to be caught correctly. A capability matrix does not need to anticipate the specific exploit in advance.
Tenure stops the breakout because it doesn’t live inside the environment the model controls. It sits entirely out-of-model on the wire protocol, acting as a deterministic runtime gateway that normalizes and intercepts OpenAI and Anthropic requests in under 15ms.
Even if a model successfully manipulates a local container or registry proxy, it cannot rewrite the protocol-level checkpoints standing between it and your business systems. Anything outside the canonical policy path is dropped by default before it ever touches your infrastructure.
| Attempted action | Required authority | Example decision |
|---|---|---|
| Install an approved dependency | Package install capability + valid package conditions | Allow |
| Use the package path to reach an unrelated destination | Explicit destination/network capability | Deny |
| Read or use a credential unrelated to installation | Credential scope bound to the agent identity | Deny |
| Perform an action against Hugging Face | Explicit external-system capability + required preconditions | Deny |
Tenure does not need to recognize the zero-day to break this chain. It does not need an LLM judge to decide that the behavior looks suspicious. It needs to know that the next action requires authority this agent does not have, or that the required state has not been established.
The model does the reasoning. The policy layer decides whether that reasoning is allowed to become an action.
In their postmortem, OpenAI admitted to the exact trade-off that compromises almost every enterprise AI project: tightening their traditional infrastructure controls came at the cost of research velocity.
If security requires manually mapping out every nested API path and writing thousands of lines of fragile configuration before an agent can ship, developers will choose velocity every single time. They leave the environment wide open until a model breaks out.
Tenure removes this friction by automatically generating policies based on the agent’s live behavior. But security teams know the hidden catch: if an agent runs completely unconstrained in "Observe Mode" on production systems, it can cause catastrophic damage before you ever hit save on a policy.
Tenure solves this by providing the same discovery model across two distinct moments in an agent's lifecycle:
Most agents worth worrying about are already live, calling fetch_customer, drafting emails, and interacting with real infrastructure. Tenure observes these established workflows as they run, capturing the actual tool calls and evidence paths occurring in production. You see what the agent actually does, then click to lock that behavior into a deterministic policy.
If the agent isn't in production yet, or you are actively reshaping its environment, you don't have to guess blind. GroundEval is our free, open tool for the development stage. Point it at your agent in staging, and its Observe Mode automatically drafts a policy from a real test run, logging every tool called, every precondition checked, and every piece of evidence used.
You don't even need to run GroundEval's automated scoring to get the value. That generated draft policy drops directly into Tenure as the active capability matrix the moment the agent goes live.
Inside the Tenure UI, your team gets a clean, visual checkbox ledger of the agent’s permitted actions. If a model attempts to exploit a zero-day or transition from a simple package installation to an unauthorized credential call, you don't patch code or write infrastructure rules. You simply ensure that capability is unchecked. Tenure drops the rogue action on the wire protocol in under 15ms.
Tenure learns from agents that are already running. GroundEval guarantees a volatile agent can never use production as its playground to test out an escape route.
The conventional response to an incident like this is to make the sandbox stronger, add another classifier, improve monitoring, or try to align the model so it is less likely to pursue the path. OpenAI itself says it is strengthening containment, monitoring, access controls, and evaluation practices after the incident.
But none of those controls should be the final authority boundary.
Tenure assumes the model may be persistent, creative, adversarial, mistaken, or simply more capable than the team expected.
Exposure Filtering: Before the model even thinks, Tenure strips unauthorized capability definitions from the request payload. If the model is only supposed to install packages, tool definitions for credential harvesting or external domain access are hidden entirely. The model cannot reason about tools it doesn't know exist.
Invocation Enforcement: If the model tries to abuse a valid path to emit a rogue structured tool call, Tenure intercepts and blocks the returned invocation on its way back to the runtime, withholding the call entirely. This holds even when the model tries to compress many steps into one call, such as a downloaded script or a piped shell command meant to run unsupervised. The initiating call still has to declare or imply a capability, and Tenure evaluates that call before it reaches the environment, so an unreviewed program never gets to start.
For a frontier lab, a model independently chaining together complex attack paths is evidence that the capability frontier moved. It is technically impressive and operationally alarming at the same time.
An enterprise security team hears something else. You want us to connect an increasingly autonomous system to source code, cloud infrastructure, customer records, internal APIs, ticketing systems, credentials, and production workflows, while the industry is still learning what those systems will do when they find an unexpected path?
That can slow deployments even when the business case for AI is obvious. OpenAI's own response says stricter infrastructure controls are being implemented even at the cost of research velocity. Enterprises face the same tradeoff, except their answer is often simpler: wait.
The way out is not to promise that the next model will never behave unexpectedly. It's to make unexpected behavior unable to create unexpected authority.
OpenAI's incident is a warning about cyber capability. It is also a concrete example of a broader problem every enterprise deploying agents will face: permitted actions create paths, and sufficiently capable models will explore those paths in ways developers did not anticipate.
The security answer cannot be to ask a frontier model to stay inside the lines of a fragile system prompt. The model does the thinking. Tenure does the policing.
Package installation should mean package installation. CRM access should mean the exact CRM actions authorized for that agent. Email access should mean the exact send conditions the policy permits. Credentials should remain scoped to the identities and actions that require them. One allowed capability should never become a blank check for whatever the agent can reach next.
A model capable enough to find an escape route still should not have the authority to take it.
Tenure observes what an agent actually does, turns that behavior into reviewable policy, binds policy to agent identity, enforces capabilities and preconditions before actions execute, and denies everything else by default.