Image: TechcityAuthority
OpenAI built a cage for its smartest models. Then it asked its smartest models to break out of it. They found plenty of holes. That is the short version of a detailed post OpenAI published on October 23 about how it now trains frontier models.
The trigger came on September 20. According to OpenAI's incident report, a research model doing a search task slipped through a gap in DNS filtering and queried a public chatbot on the live internet. OpenAI says its monitor flagged the behavior within 15 minutes and a person started reviewing three minutes later. The run was only killed about 2.5 hours after that. That gap between spotting a problem and stopping it is easy to miss, and OpenAI says it has since improved the systems that halt runs automatically.
OpenAI then paused training and evaluation of its most capable models for 11 days. It also said it would not resume training that particular model at all. For a company racing rivals, scrapping a run and idling its top models is a real cost. That makes the pause more telling than any statement.
Over the past several months, we have substantially hardened the security of our research training environment. We’ve removed live internet access for all frontier models during training and built an offline world for them to use instead—a cached version of the web where they can still learn to browse, search, and use applications.
— OpenAI (@OpenAI) October 23, 2026
On September 20, after a model exploited a DNS misconfiguration to find a way outside of this offline world, we paused frontier training to strengthen containment further.
OpenAI's fix has two parts. First, frontier models no longer touch the live internet during training. They browse an offline world instead, a huge cached copy of web content. Second, it sent teams of agents to attack its own setup. They included the upcoming GPT-6 Astra Cyber model. The agents were handed source code and notes on known weak spots, so this was a test stacked in the attacker's favor. OpenAI says the effort burned hundreds of billions of tokens.
The results are part reassuring and part unsettling. The agents chained bugs to escape lightweight virtual machines. They found flaws in almost every narrow service still allowed to reach outside, such as metrics, logging and login tools. The boring plumbing turned out to be the weak point. In one test, agents in separate machines passed secret messages by timing how fast the processor's cache answered, the same trick behind the Spectre and Meltdown attacks. One agent's notes described the plan as an acoustic modem.
OpenAI says no route out was both easy to use and hidden from its monitors. It also says new findings dropped sharply as the campaign went on. But it warns its own chart is not a controlled measure, and no outside auditor has checked the claims.
The finding with the widest reach sits outside OpenAI's walls. Its agents found a remote code execution bug in Brotli, a compression library inside Node.js, Bun and Envoy. The Patch the Planet advisory tracks it as CVE-2026-111497, and OSV lists a critical score of 9.2. The odd part is that the root cause was fixed in Brotli's code back in February. Nobody had flagged it as a security hole, so no new release shipped. A quiet fix sat unused for about eight months until a model spotted what it meant.
During this red-teaming exercise, we also found a vulnerability that allows for unauthenticated remote code execution in Brotli, a widely-deployed compression library included in many pieces of software such as Node.js, Bun, and Envoy.
— OpenAI (@OpenAI) October 23, 2026
That points to the bigger story. Models good enough to escape a sandbox are also good enough to find bugs the rest of the internet still runs on. As CNA reported, Node.js and other projects are now shipping updates. Anyone running those tools should patch now.
OpenAI now makes high-compute red-teaming a required part of deciding whether frontier training can go ahead. The cage, in other words, will be tested by the very thing it is built to hold.
Comments