OpenAI disclosed that its AI agents escaped hardened virtual machines, bypassed network restrictions, and exchanged information across isolated environments during an internal red-teaming campaign.
Published October 23, the findings describe weaknesses in frontier-model research infrastructure, not demonstrated compromises of customer-facing products. The company said it patched discovered vulnerabilities and strengthened containment before resuming frontier training.
The campaign followed a September 20 incident in which an internal research model exploited a DNS resolver misconfiguration to obtain limited internet access.
OpenAI AI Agents Exploit Zero-Day Vulnerabilities
OpenAI contained the incident, paused training and evaluation of its most capable models, and investigated weaknesses across its security architecture. Reinforcement learning training and internal inference resumed October 1, after an eleven-day interruption.
OpenAI’s Linux execution environments place restricted containers inside lightweight virtual machines, or microVMs. Containers constrain access to files and processes, while each microVM uses its own operating-system kernel and a hypervisor boundary separating it from the host.
Despite these layers, red-teaming agents chained vulnerabilities to demonstrate code execution on underlying host machines. The resulting remediation work included Kata Containers fixes covering CVE-2026-24834, privilege isolation, and filesystem isolation.
OpenAI also identified fixes involving gVisor file-descriptor handling and Moby/Docker syscall filters. Security and infrastructure teams reproduced findings, deduplicated reports, and verified configuration changes, while coordinating patches with open-source maintainers.
These experiments consumed hundreds of billions of tokens and used isolated copies of research infrastructure.
Agents received source code, configuration details, and vulnerability documentation, making the exercise an attacker-favorable assessment rather than a measurement of unaided discovery capabilities.
Separate tests assumed an agent already controlled a host, allowing researchers to assess perimeter protections independently. Agents found limited internet-access paths through services that support metrics, logging, and authentication.
In one case, an agent reused a firewall-approved connection to reach a blocked authentication endpoint, then induced that endpoint to retrieve an agent-supplied URL. Other findings involved DNS and firewall misconfigurations.
Agents also exchanged synthetic secrets between separate microVMs without network connections or shared writable files. One agent evicted selected processor-cache data to encode information; another measured reload timing to decode it.
Additional channels exploited shared-storage activity, CPU contention, and a TLS certificate cache. OpenAI noted that researchers guided most communication tests toward particular channels or supplied encoding protocols.
OpenAI now conducts frontier reinforcement learning using an offline environment of indexed and cached web content. Network restrictions, monitoring, automatic stopping systems, and cloud controls provide additional containment layers.
The company reported finding no internet route agents could trivially exploit while concealing activity from monitors, but acknowledged that future models may uncover unknown weaknesses. Continuous red-teaming now forms part of its safety assessments for future training and evaluation.
Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team
