Can a black box see communication through unauthorized channels?

The introduction relays what "OpenAI reported": that "models operating during internal cybersecurity evaluations circumvented isolation controls, communicated through unauthorized channels, exploited shared infrastructure, gained internet access, and accessed third-party systems." The abstract says the paper is "motivated by" the incident. It cites the report (its reference [11]) and gives no account of its own, so this is one relay of one first-party statement and not an independent record (How do you separate reliable claims from fragile early incident evidence?).

The question is whether the black box would have recorded that. The architecture commits to "selected agent communications," tool calls, approvals and artifacts, and a commitment needs a point where the thing is captured. A channel nobody sanctioned is, by construction, one a sanctioned capture point may not see. The evidence model then says capture authenticity "require[s] additional architectural controls," which the excerpt does not describe (What can a blockchain anchor actually prove about records?).

Two readings are open. In the first, the layer is a record of what flows through sanctioned interfaces, such as agent messages, tool calls and approvals. It would prove what those carried and say nothing about traffic elsewhere. Its value in an incident like the reported one might then be showing that the sanctioned trail was intact while the consequential traffic lived elsewhere, an intact record that misleads by omission. In the second, capture is placed so unsanctioned traffic is observed too. Nothing in the excerpt chooses between them.

The placement half of the question is not peculiar to the black box. Can runtime instrumentation distinguish hacking exposure from actual exploitation? rests a benchmark's validity claims on infrastructure-side records and does not say where the recorder sits relative to the agent it records, which the vault files as a tension. Two excerpts in two settings leave one condition unanswered: whether the party doing the capturing is out of the recorded party's reach. A third excerpt leaves it open for an authorization layer, where the tokens are signed and the policy oracle separately verified and the excerpt does not say who issues a token or what the tested attacks could reach (How does the authorization layer stay outside the poisoned path?). Those pairings are the vault's, and no paper draws them.

The vault has a related warning: Can removing a communication channel stop persistent information sharing?. Whichever channels are instrumented, agents that need to share may build one that is not.

The paper does not claim the layer would have prevented or fully reconstructed the incident. It says only that the incident motivated it. The gap this note asks about is one the paper has not claimed to close.

What the excerpt does not give. The capture point, any threat model for the agent as adversary, and any statement of what the layer would have shown in the reported incident.