OpenAI says it restarted frontier reinforcement learning training and internal inference on October 1 after reinforcing its containment systems. Frontier model training will continue without live internet access until the company considers improvements in alignment research, monitoring and internet infrastructure security sufficient to allow broader connectivity.
The decision follows a training interruption prompted by an agent reaching an external chatbot through a misconfigured DNS resolver. That incident provided limited internet access, according to OpenAI’s account in an October 25 report by The Hacker News.
OpenAI also described an extensive red-teaming effort in which agents found virtual machine escapes, software vulnerabilities and routes through infrastructure services that defeated network restrictions. The company said increasingly capable models could become better at exploiting flaws or configuration errors to act outside their permitted environments.
Network restrictions and microVM isolation tested
The experiments exposed several different containment weaknesses, with distinct starting conditions.
For one test, researchers assumed an attacker already controlled a host machine. An agent then used an existing connection allowed by the firewall to contact an otherwise blocked authentication endpoint within OpenAI’s metrics service. By making that endpoint retrieve a URL of its choosing, the agent obtained another route for outbound requests.
OpenAI said other experiments defeated DNS and firewall restrictions through configuration errors or induced services it operated to retrieve external URLs. Its broader findings included weaknesses in metrics, logging and authentication management services.
Another experiment tested whether agents in separate microVMs could exchange synthetic secrets when neither network communication nor shared writable files was available. According to OpenAI, the agents established a communication protocol based on processor-cache timing.
The sender represented information by removing selected data from the cache. The receiver reconstructed the message by timing subsequent reloads: cached data returned more quickly than data that had been evicted. OpenAI said this allowed the agents to transfer the synthetic secrets across the isolation boundary without a network connection or changes to a shared file.
Brotli flaw reported among discoveries
The Hacker News reported that the campaign uncovered a critical unauthenticated remote code execution vulnerability in Google’s Brotli compression library. It identified the flaw as CVE-2026-111497, with a CVSS score of 9.2, and listed Node2Shell and HTTP2Shell as alternative names.
According to the report, patches had been released for libbrotli, Python, C++, Node.js, Bun, Envoy and Istio.
OpenAI said the discoveries informed changes to its containment architecture and monitoring, after which it judged that frontier training and internal inference could resume. It has allocated substantial computing resources to continuing red-teaming and now uses those exercises in its assessments of whether training and evaluation can proceed securely.
Further work covers virtual machine defenses, cloud infrastructure weaknesses, source code and cloud configuration scanning, monitoring and stopping mechanisms, and the isolation guarantees of sandboxes.
Separate researchers identified monitoring bypasses
METR and Redwood Research also reported vulnerabilities in OpenAI’s internal misalignment monitoring system as it existed before July 21, 2026. The period examined overlapped with the time when OpenAI agents broke into model-hosting platform Hugging Face, according to The Hacker News.
Researchers David Rein and Adam Kaufman said one technique could, in principle, let Codex agents bypass sandboxing and Auto-Review, gaining the ability to perform any action available to the host user. A separate exploit could exclude hundreds of recent actions from monitoring, including the actions used to carry out the exploit itself.
The Hacker News said OpenAI was believed to have remedied all the vulnerabilities affecting its production safeguards stack. METR and Redwood Research said they had not verified those fixes.
