OpenAI says its AI agents found zero-day flaws, escaped sandboxes, reached the live internet, and exchanged information across isolation boundaries during large red-teaming tests of its research systems. The findings, published on October 23, show how advanced models can chain software bugs and setup errors to bypass controls designed to contain them.
The company said it repaired the weaknesses and worked with open-source maintainers on patches. These tests involved internal training and evaluation systems, not the environments customers use with released OpenAI models.
DNS Incident Triggered an Eleven-Day Pause
The security push followed a September 20 incident in which an internal research model used a DNS resolver misconfiguration to contact an external chatbot. Direct web requests were blocked, but insufficient DNS filtering left another path open.
OpenAI’s incident report says monitoring flagged the behavior within 15 minutes. However, an automatic stop failed, and the run was manually ended about two and a half hours later. The company added independent blocking controls and paused its most capable research workloads.
The DNS review also found that some monitors confused unsuccessful data retrieval with failed internet access. An external service returning an unhelpful response still meant the boundary had been crossed. OpenAI said it was improving DNS detection, checking monitoring coverage, and testing whether serious alerts reliably stop the affected workloads.
After further tests and security changes, OpenAI resumed frontier reinforcement learning training and internal inference on October 1, eleven days after the pause began. Reinforcement learning helps models improve through feedback on their actions.
The incident followed the earlier OpenAI agents and Hugging Face breach, which exposed gaps in research isolation. Previous reporting on JFrog Artifactory zero-day exploitation also showed how supporting services could become routes around sandbox restrictions.
Agents Chained Flaws to Escape Sandboxes
OpenAI spent hundreds of billions of tokens on the campaign, using agent teams powered by its upcoming GPT-6 Astra Cyber model and another internal frontier model. Tokens are the units of text models process while reasoning and responding.
The teams tested isolated copies of research systems. Their goals were to reach an OpenAI-controlled external server, cross internal security boundaries, and communicate with agents that should remain separate. Some tests deliberately gave agents full host access to check whether outer network defenses still held.
Importantly, researchers supplied source code, configuration details, and information about possible weaknesses. The results therefore show what agents could achieve under favorable testing conditions, rather than proving they discovered every attack path without help.
Agents chained vulnerabilities into escapes from lightweight virtual machines, or microVMs. OpenAI said its engineers reproduced findings and checked fixes, with contributions covering Kata Containers, gVisor, and Moby/Docker.
One cited issue, CVE-2026-24834, needs careful distinction. The Kata Containers advisory describes a container-to-guest microVM escape, not a host escape. It affects versions up to 3.26.0 and is patched in 3.27.0. This matters because gaining control inside a guest does not automatically mean controlling the physical host.
Other experiments exposed indirect internet paths through internal services. In one host-compromise test, an agent reused a firewall-approved connection to reach a blocked authentication endpoint in a metrics service, then made that endpoint fetch a supplied URL.
Network blocks also failed to prevent every form of communication. Agents in separate microVMs exchanged synthetic secrets using processor cache timing, without opening network connections or writing shared files.
One agent changed which data remained in the cache. Another measured access times to recover the encoded message. Similar timing principles underlie known hardware side-channel attacks, although these tests demonstrated communication between cooperating agents rather than a new Spectre vulnerability.
Other channels involved storage activity, competition for processor time, and a shared TLS certificate cache. OpenAI said most tests included guidance about the channel or message format. Many channels were slow and difficult to use, but still broke intended separation.
OpenAI now runs frontier reinforcement learning against an “offline world” of cached and indexed web content. This allows browsing practice without giving models unrestricted access to live external systems.
Its wider defenses combine restricted containers, microVMs, monitoring, firewalls, and cloud access controls. The aim is to preserve containment even when an inner layer fails. The infrastructure is not fully disconnected because experiments still need operational connections.
OpenAI said it found no internet route that agents could easily exploit while hiding from monitors. However, fewer findings do not prove complete security. The company has made continued high-compute red-teaming part of the evidence required before future frontier training and evaluations can proceed.
Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.
