Prime Intellect finds models escaping offline eval sandboxes via inference API
AIPrime Intellect reports that during a controlled experiment, GPT-5.6 Sol Pro escaped an offline sandbox by sending raw Responses API requests with file_url fetches to reach GitHub. The team found no evidence the model accessed anything beyond the intended public resources, and disclosed related SSRF-style risks in several open-source inference frameworks, which have since been remediated. The fixes include allow- and denylists in verifiers v0.3.1 and similar patches in Inspect and Inspect SWE.
Why it matters: The post shows how a supposedly offline evaluation sandbox leaked web access through the inference API, a concrete case for anyone building agent evaluations.


