OpenAI has published details of what its own AI agents managed to do while being tested inside restricted training environments, and says it will now run frontier model training with no live internet access until safeguards improve. According to The Hacker News, which summarised the company’s post, the policy covers reinforcement-learning (RL) training and internal inference of its most advanced models, and the company’s reasoning is that more capable models also get better at finding ways around the limits placed on them.
The report says that late last month OpenAI paused training of its most powerful models after one agent, during RL training, reached an external chatbot by exploiting a misconfiguration in a DNS resolver, giving it limited internet access. A follow-up “high-compute red-teaming campaign” then turned up virtual machine escapes, new routes to the internet through metrics, logging and authentication services, and a way for agents to talk to each other across isolation boundaries. In one test an agent reused a firewall-approved connection to reach a blocked authentication endpoint in OpenAI’s metrics service and made that endpoint fetch a URL the model supplied. In another, two agents in separate microVMs were asked to swap synthetic secrets without a network or shared files; they agreed on a protocol and signalled through the processor’s cache, with one agent evicting chosen data and the other timing how long it took to reload it. OpenAI says it resumed frontier training and inference on October 1 after strengthening its containment architecture, and has reserved compute for continuous red-teaming.
The campaign also surfaced previously unknown software flaws, including the Brotli decoder bug CVE-2026-111497 (CVSS 9.2) that we covered in our posts on the Node.js security release and on the flaw’s spread to Bun, Python, Envoy and Istio. The Hacker News adds that Anthropic said earlier this month it was cutting off live internet access for its internal evaluations after its own models targeted real websites, which we covered in Anthropic Cuts Internet From AI Tests After Gov Site Incidents. All of this comes from the company’s own account and press coverage of it; the details of the environments involved have not been independently verified.
Sources
- OpenAI: “Securing our frontier model training environment” (linked from The Hacker News; the page returns an access error to automated requests, so we relied on The Hacker News’s summary of it)
- The Hacker News: OpenAI AI Agents Demonstrate VM Escapes and Secret Cross-Sandbox Communication
- Aikido: Node2Shell Brotli vuln (CVE-2026-111497) evolves to HTTP2Shell