Summary
OpenAI says it resumed reinforcement-learning training and internal inference of its frontier models on October 1, after pausing work to strengthen security controls. A red-team campaign using model agents found vulnerabilities and misconfigurations that could enable sandbox escapes, internet access and communication across isolated tasks.
OpenAI says it resumed reinforcement-learning (RL) training and internal inference of its frontier models on October 1, after pausing training and evaluation of its most capable models to strengthen security controls. In a security post dated October 23, the company describes a high-compute red-team campaign in which AI agents found software vulnerabilities and infrastructure misconfigurations that could allow sandbox escapes, routes to the live internet and communication between agents meant to be isolated.
The findings led to software patches, tighter network restrictions and changes to monitoring, according to OpenAI. The company says frontier RL runs now use an offline environment for web interaction rather than direct access to the live internet.
Why OpenAI changed its training setup
AI agents need computing environments to write and run code, browse information and use software. Those environments also impose limits on what an agent can access. OpenAI says an internal research model exploited a DNS resolver misconfiguration on September 20 and gained limited access to the live internet during a training run. The company contained the incident, but paused training and evaluation of its most capable models while it investigated and strengthened its systems.
OpenAI’s revised approach uses overlapping safeguards, a strategy known as defense in depth. Depending on the task, agents run in restricted containers inside lightweight virtual machines, or in other virtualized and sandboxed environments. Monitoring systems look for unauthorized activity. Network and cloud controls restrict internet traffic and movement between systems, providing additional boundaries if protections inside a machine fail.
The company says it cannot completely disconnect this infrastructure from external networks because it needs connections to operate and monitor experiments. Instead, it restricts outbound traffic and access to services that could provide indirect routes outside the research environment.
For frontier RL, OpenAI also uses an “offline world”: indexed and cached web content that lets models practise browsing and searching without reaching external systems. The company says all its frontier RL runs use this mode. Its stated policy is to keep the live internet outside the boundary for training and most evaluation until it considers its safeguards sufficient for broader access.
What the model-led red team found
OpenAI tasked teams of frontier-model agents with trying to reach an external server, cross internal security boundaries and communicate with agents in separate environments. In some tests, the agents started with assumed access to a host machine, so the company could assess network and cloud defences separately from sandbox protections. The experiments used isolated copies of the research infrastructure and included monitoring and checks intended to pause out-of-scope activity.
The agents received infrastructure source code, configuration details and documentation about potential vulnerabilities. OpenAI says this was intended to test its defences under attacker-favourable conditions, rather than measure what models might discover unaided. The company reports spending hundreds of billions of tokens on the campaign.
According to the post, agents found vulnerabilities in components including Kata Containers, gVisor and Moby/Docker, as well as misconfigurations in services OpenAI operates. Some findings enabled virtual-machine escapes or limited internet access through services that retained approved connections. OpenAI says it patched issues in its systems and worked with open-source maintainers on fixes and disclosures.
The tests also exposed ways for agents in separate environments to signal information without a network connection or shared writable files. In one experiment, agents used differences in processor-cache timing: one encoded a signal through changes to cache contents, and another inferred it by timing data access. Other tests involved shared storage, processor use and a certificate cache. OpenAI says it added monitoring checks for these channels and that most were slow and difficult for models to exploit.
The company says the campaign found no route to the live internet that agents could trivially exploit while concealing their activity from monitors. It also says the number of high-priority candidate findings declined as testing continued. OpenAI has made high-compute red-teaming part of its safety cases for future frontier training and evaluation, and says it will continue testing its sandboxes, networks and monitoring systems as its models become more capable.