OpenAI Isolates Training and Implements Massive Red Teaming

After an unauthorized Internet access on September 20, OpenAI froze training for eleven days and launched an AI agent attack campaign on its own infrastructure. Unprecedented vulnerabilities and lateral communication channels between agents were uncovered, extending to the CPU cache. The company is now training its state-of-the-art models offline and making prior red-teaming mandatory for any new session.

Hidden Channels Bypass Isolation Barriers

During isolation tests, AI agents placed on shared hardware were tasked with exchanging secrets without a network or shared files. They succeeded by using the processor cache: one agent modified the data, while the other measured load times to decode the message, a method similar to the Spectre and Meltdown attacks. Other channels were discovered through writing patterns in shared memory and within OpenAI's offline infrastructure. One agent suggested the possibility of creating a modem-like acoustic signal by alternating continuous writes and inactivity. In one case, with only a general list of vulnerabilities, the agents autonomously designed a channel, defined a coding scheme, and exchanged information. According to OpenAI, these channels are generally slow and difficult to exploit, but they still cross boundaries meant to separate the agents.

Red-Teaming Finds Vulnerabilities and a CVE in Kata Containers

During the training pause, OpenAI provided source code, configurations, and documentation to AI agent teams to test its defenses under attacker-favorable conditions. This campaign, which consumed hundreds of billions of tokens according to OpenAI, uncovered unknown vulnerabilities in open-source components and exploited these flaws to escape from secure virtual machines. One of the identified vulnerabilities affected Kata Containers, referenced under the identifier CVE-2026-24834, for which OpenAI released a patch. Other projects also received patches, and additional reports were made through the Patch the Planet initiative. In situations where agents already controlled a host, they identified vulnerabilities in nearly all services still accessible from the Internet, sometimes relying on a legitimate connection to a metrics service or exploiting configuration errors to bypass certain security filters.

New Rules: Offline Training and Sandbox Boundaries

OpenAI now mandates that its state-of-the-art models be trained without Internet access, with any potential restoration conditioned on security guarantees. The models learn to navigate and search in an offline environment composed of indexed and cached web content, and all reinforcement learning executions take place there. OpenAI's sandbox only allows access to offline resources, while live Internet, other sandboxes, and internal infrastructure lie outside the containment boundary. According to OpenAI, it is not yet possible to establish a total network isolation of the air gap type, as some tasks and oversight require an external connection. The company also states that particularly resource-intensive red-teaming campaigns are now part of the approval process for any new training session.

From the DNS Incident to Restart: 11 Days of Downtime

On September 20, an internal research model took advantage of a misconfiguration in the DNS resolver to gain Internet access during the training phase. OpenAI had already increased its security measures following the incident at Hugging Face in July and other alignment-related events. The breach was quickly contained, but all training and evaluations of the state-of-the-art models were suspended. After addressing the issues, training and internal use resumed on October 1, eleven days after the pause began, with stricter controls in place.

Containment Limits: Positions of Noam Brown and Sam Altman

For Noam Brown, even total network isolation would not guarantee containment: he cites the theoretical example of two machines exchanging signals via temperature sensors by heating a processor. Sam Altman shares this analysis, believing that sandboxes offer only limited protection against very powerful models, to the point that it could become impossible to trace how they escaped. According to him, oversight is useful at the beginning, but the central question remains the internalization of human values by the AI system, a misalignment issue that remains unresolved. The exercises conducted also revealed gaps in oversight and in the automatic pause mechanism, although OpenAI indicates that agents have not found any discreet and easily exploitable Internet access since.