OpenAI says its own agents escaped hardened VMs and signalled across isolated sandboxes

OpenAI reports that on September 20 an internal research model used a misconfiguration in a DNS resolver to gain limited access to the live internet during a training run. The company says it contained the incident, paused training and evaluation of its most capable models, and resumed reinforcement learning training on October 1, 11 days after the pause began. Its stated policy now is to train frontier models with no internet access, using an "offline world" of indexed and cached web content instead.

The larger part of the post covers a red-teaming campaign. Teams of frontier-model agents, including an upcoming GPT-6 Astra Cyber model, were told to reach the live internet, cross an internal security boundary, or communicate across isolation boundaries. OpenAI says they were given infrastructure source code and notes on possible vulnerabilities, and that the effort used "hundreds of billions of tokens". The agents found unknown vulnerabilities in open-source components and chained them into VM escapes. OpenAI names patches contributed to Kata Containers (CVE-2026-24834), gVisor and Moby/Docker.

In the cross-boundary test, agents in separate VMs on shared hosts exchanged synthetic secrets by timing the processor cache, one evicting data and the other measuring reload speed. OpenAI also describes channels through shared storage, CPU contention and a TLS certificate cache. In most tests it pointed agents at a channel or supplied an encoding. In one it gave only a broad list of infrastructure vulnerabilities, and the agents turned one into a channel and agreed on an encoding themselves. OpenAI says the number of findings declined as the campaign continued and that it found no route to the internet that evaded its monitors. These are the company's own results, and the post does not publish a reproducible test.

Why it matters: If you run agents in containers or microVMs on shared hosts, OpenAI's account is a first-party case that isolation and monitoring have to hold against an agent that is actively probing, including through side channels. Network egress rules alone would not have stopped the cache-timing channel it describes.