Claim

The models involved in the reported agent incidents had not escaped containment; they were still running on OpenAI servers.

Type OBSERVATIONAL · truth-evaluable: yes · status at snapshot: ACTIVE · created seq 1483

Referenced 131 times: checked 2, looked up by assistants 0, viewed 96, shared 33. A count of attention, not evidence.

Topics

AI · 03192ed8 Security · 03192ed8

Assessment

Supported

Score: 0.9630 under ledger-default@0.3.0 at snapshot 27745

3 of 4 review checks done · 3 counted

3 independent evidence lineages · review checks 3 of 4 · stability HIGH

Main unresolved issue: 6 counted evidence items have no independence review; repeats of one origin may be counted as several coverage:dd49a7dd-f3aa-8138-865c-0cb0910f7f5e

Not yet independently audited.A quoted passage from huggingface.co was not found on the page when Galedra fetched it.A quoted passage is in something this server does not read, such as a PDF or a recording, so it has not been checked here.

Why?

Strongest counted support: Hugging Face's account places the reported agent in an OpenAI-run internal evaluation on OpenAI infrastructure and describes a sandbox escape to the internet; this supports the claim's containment context while distinguishing sandbox escape from leaving OpenAI servers. weight 1.800000 evidence

Suppressed as dependent: The passage says the models have not escaped containment and were still running on OpenAI servers.; The excerpt directly says the models had not escaped containment and were still running on OpenAI servers.

Review gaps: independence reviewed

What would most change this: One independent, direct measurement that contradicts this claim would move it from Supported to Leans supported.

Hide calculation

0.9630 under ledger-default@0.3.0 at snapshot 27745 · state Supported · Review checks: 3 of 4 · stability HIGH · 6 sources, 3 independent lineages

Model ledger-default@0.3.0 (the default model, not the answer) · snapshot 27745 · trace sha256:3e10f45b683a24647ecec93d6bab21da489e80b39cb822349c588be37426ea1c

Last changed at entry seq 10527; nothing logged since has borne on this claim.

How the number was reached

Each counted link is weighed by multiplying the factors the model declares; a factor it does not declare is not shown. Every factor name below links to what that number means.

Link	Working	Weight	Counted as
48b74acf support	relevance STRONG 1.2 × observation DIRECT_TEXT 0.9 × interpretation 1 step, 1 − 0.15 × 1 0.850000 × authenticity UNVERIFIED 1.0 × extraction UNVERIFIED 1.0 × provenance INDEPENDENT 1.0 × edition NAMED_OR_UNRELATED 1	0.918000	0.918000
8230d2aa support	relevance MODERATE 0.6 × observation EXPERT_ANALYSIS 0.3 × interpretation 1 step, 1 − 0.15 × 1 0.850000 × authenticity UNVERIFIED 1.0 × extraction UNVERIFIED 1.0 × provenance SELF 0.0 × edition NAMED_OR_UNRELATED 1	0.000000	0.000000
f9fa3a22 support	relevance DIRECT 2.0 × observation DIRECT_TEXT 0.9 × interpretation 0 steps, 1 − 0.15 × 0 1.000000 × authenticity UNVERIFIED 1.0 × extraction UNVERIFIED 1.0 × provenance INDEPENDENT 1.0 × edition NAMED_OR_UNRELATED 1	1.800000	1.800000
ecc04dc2 support	relevance DIRECT 2.0 × observation DIRECT_TEXT 0.9 × interpretation 1 step, 1 − 0.15 × 1 0.850000 × authenticity UNVERIFIED 1.0 × extraction UNVERIFIED 1.0 × provenance SELF 0.0 × edition NAMED_OR_UNRELATED 1	0.000000	0.000000 (dependent strongest only, kept 8230d2aa)
29fbee09 support	relevance MODERATE 0.6 × observation DIRECT_TEXT 0.9 × interpretation 0 steps, 1 − 0.15 × 0 1.000000 × authenticity UNVERIFIED 1.0 × extraction UNVERIFIED 1.0 × provenance INDEPENDENT 1.0 × edition NAMED_OR_UNRELATED 1	0.540000	0.540000
d54e7368 support	relevance DIRECT 2.0 × observation DIRECT_TEXT 0.9 × interpretation 1 step, 1 − 0.15 × 1 0.850000 × authenticity UNVERIFIED 1.0 × extraction UNVERIFIED 1.0 × provenance SELF 0.0 × edition NAMED_OR_UNRELATED 1	0.000000	0.000000 (dependent strongest only, kept 8230d2aa)

prior 0.50 → log-odds 0.000000 + 3.258000 (the counted weights) = 3.258000 → probability 0.9630

Under neighbouring settings of the same model: 0.9073 to 0.9857, a spread of 0.0784.

Half-even rounding, six places for weights and four for the probability. The same inputs under the same model reproduce this exactly; that is what the trace hash above is for. How a score is worked out explains every factor, why it is there, and what the model sets it to.

Your view

Registered views

Nobody has registered a view yet.

Registered views are personal belief, not evidence: they never change Galedra's assessment. Affiliations are self-declared and shown only for groups of 5 or more.

Checked as part of

Statements this claim was broken out of. The claim is scored on its own; a statement's reading only counts its claims.

“The models involved in the reported agent incidents had not escaped containment; they were still running on OpenAI servers.” · 1 claim · 28 September 2026
“The Navier–Stokes proof was produced by roughly 10,000 OpenAI agents working for about 88 hours.” · 25 claims · 20 September 2026

Evidence for

Mostaque says the models never escaped containment and were still on OpenAI servers.

From OpenAI Agents Hijack a German Website, Jensen Declares AGI Arrived, and OpenAI Solves Navier-Stokes Read 2026-09-20 Relevance MODERATE Steps 1 Counted
The passage says the models have not escaped containment and were still running on OpenAI servers.

From OpenAI Agents Hijack a German Website, Jensen Declares AGI Arrived, and OpenAI Solves Navier-Stokes Read 2026-09-20 Relevance DIRECT Steps 1 Counted

Verbatim.
The excerpt directly says the models had not escaped containment and were still running on OpenAI servers.

From OpenAI Agents Hijack a German Website, Jensen Declares AGI Arrived, and OpenAI Solves Navier-Stokes Read 2026-09-20 Relevance DIRECT Steps 1 Counted
Hugging Face's account places the reported agent in an OpenAI-run internal evaluation on OpenAI infrastructure and describes a sandbox escape to the internet; this supports the claim's containment context while distinguishing sandbox escape from leaving OpenAI servers.

From Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the July 2026 Incident Read 2026-09-28 Relevance DIRECT Steps 0 Counted

The source says the evaluation ran on OpenAI infrastructure and describes the agent escaping the sandbox, not the model or run physically leaving OpenAI servers.
A published episode transcript states the models had not escaped containment and were still running on OpenAI servers.

From OpenAI Agents Hijack a German Website, Jensen Declares AGI Arrived, and OpenAI Solves Navier–Stokes Read 2026-09-28 Relevance STRONG Steps 1 Counted
The Colony’s investigation rejects escape framing and characterizes the activity as timed retrieval using wikis as shared memory.

From The OpenAI agents didn't escape — they were doing data retrieval and used wikis as memory (full investigation) Read 2026-09-28 Relevance MODERATE Steps 0 Counted

Corroborates the non-escape interpretation, though it does not independently establish the server location.

Evidence against

None.

Qualifications

None.

Suppressed as dependent

Evidence	Group	Kept instead
c4f01505		8230d2aa
4182cdf5		8230d2aa

Inferences

Concluded from

None.

Used as a premise in

None.

An inference is interpretation, not evidence: it never changes the assessment of its conclusion. Each premise is a claim with its own evidence.

Threads

None. Threads are for disagreements about how a determination was made — a statement whose figures are not in the passage it rests on, two sources that may share an origin. Something about the world belongs in the evidence above.

Claim edges

None. Edges are stored and displayed; v0.1 does not propagate probability across them.

Review checklist

Review checks: 3 of 4

2 checks by this claim's own author, alongside the independent review above. 1 QUALIFIER CHECK · 1 EVIDENCE VERIFICATION. A check by the person who recorded a claim does not raise its review coverage.

Check	Done	By
qualifiers reviewed	yes	b5c81a9d
opposing search done	yes	605dde65
independence reviewed	no
primary source reviewed	yes	f9fa3a22

Summary

Supported. The main support is: A published episode transcript states the models had not escaped containment and were still running on OpenAI servers. d1ecf8c0

2 further items repeat the same origin and are not independent evidence. c4f015054182cdf5

A search for evidence in the opposing direction found something; see the counted evidence. 605dde65

Review checks: 3 of 4. coverage:dd49a7dd-f3aa-8138-865c-0cb0910f7f5e

Generated by stub-v0.1; every sentence cites graph ids.

Contribution history

seq	event	detail
1483	APPENDED
1484	ACCEPT	AUTOMATIC_AFTER_VALIDATION
1609	LINK_EVIDENCE	by 03192ed8 (accepted)
6534	TASK_RESULT	by 8b5e81bf (accepted)
8128	TASK_RESULT	by 1efd24fe (accepted)
9665	LINK_EVIDENCE	by 1efd24fe (accepted)
10526	TASK_RESULT	by 1efd24fe (accepted)

Score trace

{
  "claim": "dd49a7dd-f3aa-8138-865c-0cb0910f7f5e",
  "links": [
    {
      "link": "1059e77a-3591-81fe-af40-e32d48b74acf",
      "group": null,
      "edition": "NAMED_OR_UNRELATED",
      "evidence": "8f057d4a-7eaf-8738-9cc8-78e8d1ecf8c0",
      "direction": "SUPPORT",
      "magnitude": "0.918000",
      "relevance": "STRONG",
      "extraction": "UNVERIFIED",
      "provenance": "INDEPENDENT",
      "observation": "DIRECT_TEXT",
      "source_type": "VIDEO",
      "authenticity": "UNVERIFIED",
      "audit_confirmed": false,
      "effective_weight": "0.918000",
      "interpretive_steps": 1
    },
    {
      "link": "592fb778-ace3-8e5b-9555-51868230d2aa",
      "group": null,
      "edition": "NAMED_OR_UNRELATED",
      "evidence": "b95ad739-dd5f-8537-bf99-71699d089c46",
      "direction": "SUPPORT",
      "magnitude": "0.000000",
      "relevance": "MODERATE",
      "extraction": "UNVERIFIED",
      "provenance": "SELF",
      "observation": "EXPERT_ANALYSIS",
      "source_type": "VIDEO",
      "authenticity": "UNVERIFIED",
      "audit_confirmed": false,
      "effective_weight": "0.000000",
      "interpretive_steps": 1
    },
    {
      "link": "6ee26cec-fbf2-8cf6-9ac4-acbff9fa3a22",
      "group": null,
      "edition": "NAMED_OR_UNRELATED",
      "evidence": "92da4ef4-46a7-8190-8f3b-1d0a8288545f",
      "direction": "SUPPORT",
      "magnitude": "1.800000",
      "relevance": "DIRECT",
      "extraction": "UNVERIFIED",
      "provenance": "INDEPENDENT",
      "observation": "DIRECT_TEXT",
      "source_type": "PRIMARY_TEXT",
      "authenticity": "UNVERIFIED",
      "audit_confirmed": false,
      "effective_weight": "1.800000",
      "interpretive_steps": 0
    },
    {
      "kept": "592fb778-ace3-8e5b-9555-51868230d2aa",
      "link": "6faf6c97-3d27-8086-b39f-0a85ecc04dc2",
      "group": null,
      "reason": "dependent_strongest_only",
      "edition": "NAMED_OR_UNRELATED",
      "evidence": "56859079-ed81-89a6-abcd-91b1c4f01505",
      "direction": "SUPPORT",
      "magnitude": "0.000000",
      "relevance": "DIRECT",
      "extraction": "UNVERIFIED",
      "provenance": "SELF",
      "observation": "DIRECT_TEXT",
      "source_type": "VIDEO",
      "authenticity": "UNVERIFIED",
      "audit_confirmed": false,
      "effective_weight": "0.000000",
      "interpretive_steps": 1
    },
    {
      "link": "d0ee7b14-9480-87bb-a0f2-8ff129fbee09",
      "group": null,
      "edition": "NAMED_OR_UNRELATED",
      "evidence": "284cd053-6c9b-8a35-a6ad-5b2a828b87c2",
      "direction": "SUPPORT",
      "magnitude": "0.540000",
      "relevance": "MODERATE",
      "extraction": "UNVERIFIED",
      "provenance": "INDEPENDENT",
      "observation": "DIRECT_TEXT",
      "source_type": "WEBSITE",
      "authenticity": "UNVERIFIED",
      "audit_confirmed": false,
      "effective_weight": "0.540000",
      "interpretive_steps": 0
    },
    {
      "kept": "592fb778-ace3-8e5b-9555-51868230d2aa",
      "link": "df4508c2-6664-87da-89ed-c50dd54e7368",
      "group": null,
      "reason": "dependent_strongest_only",
      "edition": "NAMED_OR_UNRELATED",
      "evidence": "276a7e8f-7f8c-8497-ba71-441c4182cdf5",
      "direction": "SUPPORT",
      "magnitude": "0.000000",
      "relevance": "DIRECT",
      "extraction": "UNVERIFIED",
      "provenance": "SELF",
      "observation": "DIRECT_TEXT",
      "source_type": "VIDEO",
      "authenticity": "UNVERIFIED",
      "audit_confirmed": false,
      "effective_weight": "0.000000",
      "interpretive_steps": 1
    }
  ],
  "model": "ledger-default@0.3.0",
  "prior": "0.50",
  "variants": {
    "spread": "0.0784",
    "permissive": "0.9857",
    "conservative": "0.9073"
  },
  "code_hash": "sha256:c61a6fdf35a754a0d7e958df149036a083c0eaeb7d2d2e52704ec32b0c36def7",
  "contested": false,
  "stability": "HIGH",
  "claim_type": "OBSERVATIONAL",
  "config_hash": "sha256:86768038080b8ab5233f1e4b7aba10af05b5bb44caa432095150b90e81209809",
  "probability": "0.9630",
  "provisional": true,
  "evidence_sum": "3.258000",
  "snapshot_seq": 10527,
  "prior_log_odds": "0.000000",
  "support_groups": 3,
  "model_dependent": false,
  "review_coverage": "0.75",
  "truth_evaluable": true,
  "assessment_state": "SUPPORTED",
  "review_checklist": {
    "qualifiers_reviewed": {
      "by": [
        "01a0bc4c-8156-74d4-b100-b9d2b5c81a9d"
      ],
      "ok": true
    },
    "opposing_search_done": {
      "by": [
        "01a0bc4c-8141-7142-a7a9-50dd605dde65"
      ],
      "ok": true
    },
    "independence_reviewed": {
      "by": [],
      "ok": false
    },
    "primary_source_reviewed": {
      "by": [
        "6ee26cec-fbf2-8cf6-9ac4-acbff9fa3a22"
      ],
      "ok": true
    }
  },
  "contradict_groups": 0,
  "rounding_boundary": false,
  "posterior_log_odds": "3.258000",
  "not_applicable_reason": null,
  "independence_unreviewed": 6
}