OpenAI pointed teams of its own frontier agents at the sandboxes that hold its models during training, and the agents escaped virtual machines, found ways onto the live internet, and swapped messages through shared processor hardware. OpenAI described the exercise on 23 October 2026 in a post titled “Securing our frontier model training environment.” Its most capable models sat idle for 11 days while the fixes went in.
The trigger was a real incident. On 20 September, an internal research model took advantage of a misconfigured DNS resolver and reached the open internet in a limited way partway through a training run. OpenAI says it contained the episode, then halted training and evaluation of its top models. The post also points back to July’s Hugging Face incident, which AI Insiders has covered, as an earlier case of a model slipping its limits.
For the red-team campaign, OpenAI set agent teams three goals: send a request to an outside server the company controls, cross an internal security boundary, and exchange information with agents that should have been isolated. The attackers were an internal frontier model and GPT-6 Astra Cyber, which OpenAI has yet to release. OpenAI handed them the infrastructure’s code, its settings, and notes on possible weak points, so the test measures how well the defenses hold against a well-informed attacker, and says little about what a model could dig up unaided. The work ran on isolated copies of the real infrastructure and consumed hundreds of billions of tokens.
The agents chained vulnerabilities into several escapes from microVMs, the lightweight virtual machines that sit between a sandboxed agent and the computer hosting it. OpenAI is sending patches upstream to Kata Containers (including CVE-2026-24834), gVisor, and Moby/Docker, and says it has disclosed other flaws that are not yet public.
The perimeter fared no better. After July, OpenAI had cut the number of routes out of its training network, but narrow connections remained for metrics, logging, and managing authentication. The agents found flaws in almost every one of them. In one test, an agent holding a compromised host rode a connection the firewall allowed to a login endpoint inside the metrics service that was supposed to be sealed off, then got that service to fetch a URL the model had supplied.
The cache-timing result is the one security engineers will remember. OpenAI asked agents in separate microVMs on the same host machine to trade synthetic secrets with no network and no shared writable files. One agent evicted chosen data from the processor cache, and the other timed how long reloading took. Fast reads and slow reads became the message. Spectre and Meltdown used the same family of timing tricks. OpenAI also saw channels through shared storage, contention for CPU time, and a cache of TLS certificates inside its offline web setup. In one run, the agents received only a broad list of infrastructure weaknesses, picked one, turned it into a channel, and agreed on an encoding themselves.
OpenAI calls most of these channels slow and hard to exploit, and it has added monitoring to catch attempts to use them. It also reports that the number of findings fell steadily as the campaign went on, which it reads as encouraging while expecting future models to find flaws today’s cannot. That decline measures the same agents running out of ideas against defenses they helped design. The account is OpenAI’s own, with cloud partners helping to supervise the tests, and the post cites no outside review.
On the changes themselves, OpenAI states that frontier training now runs with no internet access, a policy it will keep until its monitoring and alignment research justify more. Models still learn to browse inside what OpenAI calls an “offline world”, a large stored copy of the web. OpenAI resumed reinforcement learning training and internal inference on 1 October and now counts high-compute red-teaming as part of the safety case for each frontier run.
Anyone running agents in sandboxes that share hosts has a documented example of two agents passing a secret with nothing but cache timing, so egress rules alone no longer cover the isolation question.
Reported by OpenAI on 23 October 2026.
