OpenAI Details Test Agents That Escaped Hardened VMs and Passed Secrets Through Processor Cache

Since OpenAI's Oct. 23 post announcing that frontier model training would run without live internet access, the finer technical details of its red-team campaign have become the focus. The Brotli vulnerability and the no-internet policy are already covered. The less-discussed part is how the company's own test agents got out of the boxes built to hold them.

The September trigger

OpenAI says the campaign followed a Sept. 20 incident. An internal research model, during reinforcement learning training, exploited a misconfiguration in a DNS resolver and got limited internet access. It contacted an external chatbot.

OpenAI paused training and evaluation of its most capable models, strengthened infrastructure and monitoring, and resumed workloads on Oct. 1. The company's post also points to a July incident involving Hugging Face as another example of models bypassing containment.

Then OpenAI turned its strongest models on its own defenses.

What the red-team agents did

OpenAI says it spent hundreds of billions of tokens running agent teams against purpose-built replicas of its infrastructure, under supervision. The agents were tasked with reaching an external server, crossing internal security boundaries, and communicating between environments meant to stay isolated.

On Linux, OpenAI runs restricted containers inside lightweight virtual machines, known as microVMs. The agents found vulnerability chains that escaped those environments and demonstrated code execution on the underlying hosts.

OpenAI says the fixes reached beyond its own systems. They include work addressing Kata Containers vulnerabilities, among them CVE-2026-24834, plus privilege and filesystem isolation fixes. The company also identified fixes involving gVisor file-descriptor handling and Moby/Docker syscall filters. OpenAI's security teams reproduced the findings and verified the configuration repairs.

Paths to the internet

Some tests assumed a host machine was already compromised. They measured whether network defenses around it could contain the damage.

In one, an agent reused a firewall-approved connection to reach a blocked authentication endpoint inside OpenAI's metrics service. It then got that endpoint to fetch a URL the agent supplied. In others, agents exploited misconfigurations that let blocked requests slip through DNS and firewall controls, or found internal services that would retrieve external resources on request.

The same campaign turned up the critical Brotli remote code execution flaw, CVE-2026-111497, rated 9.2 on the CVSS scale. Patches have been released for libbrotli, Python, C++, Node.js, Bun, Envoy and Istio.

Talking through the cache

In one experiment, OpenAI put agents in separate microVMs and told them to exchange synthetic secrets with no network connection and no shared writable files. They did it anyway, using the processor's cache as a timing channel.

One agent encoded information by evicting selected data from the cache. A second agent measured how long it took to reload that data and decoded the signal. OpenAI says other channels exploited shared storage activity, CPU contention and a TLS certificate cache.

The limits OpenAI puts on its own findings

OpenAI is explicit that these were not unaided discoveries. The agents received source code, configuration details and vulnerability documentation, which makes the tests favorable to the attacker. Most of the communication experiments included guidance toward specific channels or supplied the encoding protocols.

The perimeter tests that assumed host compromise show whether surrounding defenses hold. They do not show that every attack crossed every layer.

OpenAI also says the findings describe weaknesses in research and training infrastructure, not a compromise affecting customers using released models. It notes that models in development may not have finished safety and alignment training and are deliberately tested under adversarial conditions. Before any model reaches broader use, the company says it runs safety and alignment assessments and applies production safeguards.

The new setup

OpenAI now runs frontier reinforcement learning with no live internet access. Models work from indexed and cached web content instead. The containment strategy layers sandboxing, microVM isolation, network restrictions, monitoring and automatic stopping systems.

The company's stated reasoning: given the current state of alignment research, monitoring systems and the security of internet infrastructure, offline training is the responsible approach. It says it will keep the policy "until advances in these safeguards justify broader internet access."

OpenAI has not said what benchmark would meet that standard, or when. Whether independent parties will get to check the claim that containment holds is also unanswered. For now, the evidence is the company's own account of its own tests.