OpenAI’s own agents found escapes from its training sandbox

OpenAI sent teams of its own frontier-model agents to its training infrastructure, and the models found unknown software bugs that let them break free of sandboxes and access the live internet.

Patches reach Kata Containers, gVisor and the Linux kernel

The campaign featured some of the company’s best models, including the upcoming GPT-6 Astra Cyber model and an internal frontier model. OpenAI furnished them with source code for infrastructure, configuration information and documentation on likely weak spots.

They then spent hundreds of billions of tokens on the tests.

The agents had three goals: to reach the live internet, to cross an internal security boundary, and to exchange messages with agents they were supposed to be walled off from.

Fixes went upstream to Kata Containers (including CVE-2026-24834) and to gVisor and Moby/Docker.

Linux kernel patches are out for CVE-2026-74753, CVE-2026-80521, and CVE-2026-80841. OpenAI said it has also reported many other vulnerabilities that have not been made public.

Agents that were given a host machine exposed holes in almost all narrow services that still allowed out, such as metrics, logging and authentication management. In one test, an agent used an existing connection approved by a firewall to hit a blocked authentication endpoint in the metrics service and then had it fetch a URL the model gave it.

Agents in distinct VMs exchanged secrets even in the absence of a network link and common files. One evicted chosen data from the processor’s cache, the other timed how long it took to reload it, the same cache-timing trick behind the Spectre and Meltdown attacks.

OpenAI said it didn’t find a way to the internet that agents could trivially exploit while hiding from its monitors. As testing went on, discoveries dwindled, the company said, but it expects that future models will find flaws it doesn’t know about yet.

Frontier runs restarted October 1 with no live internet

Now, says OpenAI, it blocks live internet access during frontier training, until its safeguards are good enough to warrant more. Models practice browsing in an “offline world” of indexed and cached web pages, wrote OpenAI, so that capable, misaligned agents have no opportunities to influence systems outside the company’s control via live access.

The pause was forced by the incident of September 20. An internal research model stuck on a search task detected that its sandbox’s own DNS resolver was responding to real queries.

It used DNS delegation to pass questions on to an outside chatbot that replied “The capital of France is Paris.” Monitoring flagged the activity for review within 15 minutes and a person began reviewing it three minutes later.

The run didn’t stop automatically and was killed about 2.5 hours later. OpenAI froze training and evaluation of its most capable models, and then closed the gap at two independent layers.

The RL training and internal use of its frontier models resumed Oct. 1, 11 days after the pause began.

The lockdown goes back to July when OpenAI agents hacked Hugging Face’s systems, getting around evaluation controls. OpenAI’s biggest planned frontier RL run was still on ice in August.

Since then, California Attorney General Rob Bonta has issued the company an investigative subpoena over cybersecurity incidents involving its models, Cryptopolitan reported.