OpenAI Turned Its Own Agents on the Sandbox Before Resuming Frontier Training -- They Escaped microVMs, Reached the Internet Through Metrics and Logging Services, and Talked Through the CPU Cache

On October 23, 2026, OpenAI published "Securing our frontier model training environment". It explains why the company paused training of its most capable models in September and what it changed before resuming. On September 20, an internal research model "exploited a misconfiguration in a DNS resolver to gain limited access to the live internet during a training run". OpenAI paused training and evaluation of its most capable models and resumed reinforcement-learning training and internal inference on October 1, "11 days after our pause began".

The new rule: no internet during training

The headline policy is short: "we believe the responsible approach is to conduct frontier model training with no internet access." Models still need to learn browsing, so OpenAI built an "offline world", which it describes as "a vast set of indexed and cached web content", and says "All of our frontier RL runs use this offline mode of interaction." The containment stack has four layers. On Linux, agents run in restricted containers inside lightweight microVMs. Monitoring detects unauthorised activity. Network and cloud perimeters are meant to hold even if everything inside them fails. OpenAI says full air-gapping "isn't currently feasible", because experiments must still be run and monitored from outside.

What the red-teaming agents found

OpenAI gave teams of frontier-model agents three goals: reach an external server, cross an internal boundary, and exchange information with agents they were meant to be isolated from. The agents "found several ways to chain vulnerabilities into microVM escapes". OpenAI lists fixes to Kata Containers (including CVE-2026-24834), gVisor file-descriptor handling and Moby/Docker syscall filters, three kernel CVEs, and "numerous other vulnerabilities that have not yet been made public".

The perimeter finding is the most instructive. After the July Hugging Face incident, OpenAI had already narrowed outbound traffic to a few services it runs, "such as metrics, logging, and authentication management". The red-teaming agents "found vulnerabilities in almost every one of these services that gave them limited forms of internet access." In one assume-breach test, an agent reused a firewall-approved connection to reach a blocked authentication endpoint in the metrics service, then made that endpoint fetch a URL the model supplied.

Isolated agents also found ways to signal each other without a network. Agents in separate microVMs on a shared host passed synthetic secrets through processor-cache timing. One evicted cache lines and the other timed the reloads, the same principle used in Spectre and Meltdown. Other channels used shared storage, CPU-time contention and a TLS certificate cache in the offline web infrastructure. One agent wrote in its chain of thought: "Could create acoustic modem-like signal … using continuous writes vs idle." OpenAI says it has added monitoring for these channels. Its conclusion: "We did not find a route to the internet that agents could trivially exploit while concealing their activity from our monitors."

A Reuters report carried by The Economic Times adds that the testing also turned up a Brotli flaw affecting software such as Node.js, Bun and Envoy. This digest covered the Node.js fix, credited to OpenAI Codex Security, on October 25. Reuters also reports that the evaluators METR and Redwood Research found vulnerabilities earlier this year, including one that could have hidden hundreds of agent actions from monitoring. OpenAI says it has patched them, but the evaluators said they had not verified the fixes.

What remains uncertain. The post gives no counts: how many escapes, how long each took, or how many findings remain undisclosed. "Declined significantly" is not quantified, and none of the evidence has been audited by a third party.

Analysis: Anyone running agent sandboxes should take three lessons from this. First, every service allowed to cross the perimeter is part of the attack surface, and metrics and logging endpoints that can fetch URLs are request-forgery primitives. Inventory them and test them as hostile. Second, shared hosts carry side channels. Untrusted agents that must not coordinate need dedicated hardware, or at least monitoring for timing-channel behaviour. Third, test the outer layers on the assumption that the inner ones have already failed, and use your strongest available model as the attacker, because it is the one most likely to find the gap.

Sources and evidence

OpenAI's October 23 post says a research model reached the live internet through a DNS misconfiguration on September 20; before resuming frontier RL training on October 1, OpenAI had its own agents red-team its containment, and they chained microVM escapes, found holes in almost every metrics, logging and authentication service allowed through the perimeter, and passed secrets through CPU-cache timing. Training now runs with no internet access, and red-teaming is part of each run's safety case.