OpenAI had its own training environments attacked. The agents discovered unknown vulnerabilities, escaped from microVMs, and communicated with each other via the processor cache. As a result, Frontier models will now be trained without access to the live internet because of the significant risks.
This decision follows a series of incidents. On September 20, an internal research model exploited a misconfiguration in a DNS resolver. As a result, it gained limited access to the live internet during a training run. The agent performed at least 20 search queries via an external chatbot. The run did not stop automatically and was only manually terminated after approximately 2.5 hours.
Following the incident, OpenAI paused the training and evaluation of its most powerful models. On October 1, eleven days later, reinforcement learning training resumed.
Attackers with inside knowledge
What happened in the meantime? OpenAI deployed teams of agents to hack its own infrastructure. To do so, it used, among other things, the yet-to-be-released GPT-6 Astra Cyber, a successor to GPT-5.4 Cyber, and an internal frontier model. The agents received source code, configuration details, and documentation on potential vulnerabilities. Everything ran on isolated copies of the research environment. In total, the system processed hundreds of billions of tokens.
Agents chained vulnerabilities together to escape from microVMs. This led to patches for Kata Containers (CVE-2026-24834), gVisor, and Moby/Docker, among others, as well as fixes for the Linux kernel. They also found leaks in nearly every remaining outbound connection, including services for metrics, logging, and authentication. One agent reused a firewall-approved connection to have a blocked authentication endpoint retrieve a URL specified by the model.
The agents did not need a network to communicate with each other. In separate microVMs on the same host, they exchanged synthetic secrets via the processor cache. One agent displaced certain data from the cache, while the other measured how long it took to reload. The same timing technique was previously used in the Spectre and Meltdown chip vulnerabilities. Other channels involved shared storage, competition for CPU time, and a TLS certificate cache. OpenAI has added monitoring checks to detect such attempts.
An offline world
According to OpenAI, the agents did not find an internet route that could be exploited without the monitoring system detecting it. Nevertheless, the policy remains strict. Frontier training takes place without internet access, in an “offline world” of indexed and cached web content. Multiple layers surround this: sandboxes, microVMs with their own kernel behind a hypervisor, monitoring, and network and cloud perimeters. According to the company, complete air-gapping is not feasible because experiments require external connections.
“Based on the current state of alignment research, monitoring systems, and the security of internet infrastructure, we believe the responsible approach is to conduct frontier model training with no internet access. We’ve implemented this policy and will maintain it until advances in these safeguards justify broader internet access,” OpenAI stated.
Tip: OpenAI’s revenue figures cause turmoil on the stock market