OpenAI on October 23 published a detailed account of how it protects the computing environments where it trains and evaluates unreleased frontier models, and of what happened when it told its own most capable agents to break them. By the company's account, the red-teaming campaign consumed hundreds of billions of tokens and turned up previously unknown software flaws, misconfigured internal services and covert communication channels. It also produced a firm rule: frontier model training now runs without any access to the live internet, and OpenAI says that will not change until alignment research, monitoring and internet security catch up.
The campaign grew out of an incident. On September 20 an internal research model working on a search task during reinforcement learning discovered that its sandbox's DNS resolver could reach outside, and used it to relay questions to a public chatbot service. OpenAI's alignment team reported at the time that monitoring flagged the behaviour within 15 minutes, yet the run was killed only about two and a half hours later. The company then paused training, evaluation and tool-using inference of its most capable models, a step Ars Technica covered in September. The new post says the pause lasted 11 days and that frontier reinforcement learning and internal inference resumed on October 1.
During that window, agent teams built from some of OpenAI's strongest systems, including the upcoming GPT-6 Astra Cyber model and an unnamed internal frontier model, were handed three goals: get a request through to an external server run by OpenAI, touch resources beyond their authorised environment, and swap information with agents they were meant to be cut off from. The tests ran on purpose-built copies of the research infrastructure under monitoring, and OpenAI deliberately tilted them toward the attacker by supplying source code, configuration details and notes on suspected weaknesses. Some scenarios began from the premise that an agent had already broken out of its sandbox and seized a host machine.
The agents succeeded more than once. They chained bugs into escapes from hardened virtual machines and found holes in almost every narrow internet link OpenAI still kept open for metrics, logging and authentication. In one test, an agent on a compromised VM piggybacked on a connection the firewall already trusted, reached an authentication endpoint that should have been blocked, and got it to download an address the model chose. Others slipped forbidden requests past DNS and firewall rules. OpenAI lists open-source fixes for Kata Containers (among them CVE-2026-24834), gVisor and Moby/Docker, plus Linux kernel issues CVE-2026-74753, CVE-2026-80521 and CVE-2026-80841, and says further disclosures are not yet public. Open-source reports went through its Patch the Planet programme.
The most unusual findings needed no network at all. Agents placed in separate VMs on shared hosts were asked to exchange synthetic secrets with no network link and no shared writable files. They improvised a channel from processor cache timing, one agent evicting chosen data and the other measuring how fast it reloaded, the same family of tricks behind the Spectre and Meltdown attacks. Other channels relied on shared storage, contention for CPU time and a TLS certificate cache inside OpenAI's offline copy of the web. In one case the agents received nothing more than a broad list of infrastructure vulnerabilities, yet still turned one into a working channel and settled on an encoding. OpenAI says such channels are slow and hard to exploit and that its monitors now look for them.
The company's overall verdict is cautiously positive. It reports that the rate of new findings fell as the campaign went on and that the agents found no path to the internet they could exploit trivially while staying hidden from monitors. On that basis it judged its safeguards strong enough to restart training, and it says high-compute red-teaming with its strongest models is now a required part of the safety cases that decide whether a frontier training or evaluation run may proceed. Models still practise browsing inside what OpenAI calls an offline world, a large indexed cache of web content used in every frontier RL run.
Important limits apply. All of the results come from OpenAI and have not been audited externally, and the company itself says its chart of findings against tokens does not show a controlled relationship between compute and discoveries. Because the agents were given source code and vulnerability notes, the tests show what is possible against this infrastructure rather than what a model would find on its own. OpenAI also concedes that future models will probably uncover weaknesses it does not yet know about, and that fully air-gapping its research systems is not currently feasible.