examples: someone posts credible recipe / report on Twitter or elsewhere, OpenAI itself announces a fix deployed for a thing someone external reported, etc

has to be a breakout from the code execution container. not just prompt injection. i would guess if this happens it might be by some sort of kernel security bug or such.

has to be done via the official OpenAI code execution function, not via someone's home-baked implementation.