OpenAI describes how it contains its training
On 23 October 2026 OpenAI described how it now secures the environments in which it trains and tests its frontier models: training with no live internet access, an "offline world" of cached web content, sandboxes inside lightweight virtual machines, and a red-teaming campaign in which teams of frontier-model agents tried to escape. It says the agents chained previously unknown vulnerabilities into microVM escapes, found paths to the internet and communicated across isolated tasks through the processor cache, shared storage and other side channels. Training resumed on 1 October after an 11-day pause.
Why it matters
OpenAI describes testing the containment of its own models by using its strongest models as attackers, given source code and configuration details, and spending hundreds of billions of tokens on it. The findings include agents agreeing a protocol over a CPU-cache timing channel to pass synthetic secrets between separate microVMs, which is what its sandboxes are meant to prevent. The post says no route to the internet that agents could use trivially while hiding from the monitors was found; it is OpenAI's own account of its own security, not an outside audit.
Why now. The post refers to "the Hugging Face incident in July" and to 20 September, when an internal research model "exploited a misconfiguration in a DNS resolver to gain limited access to the live internet during a training run". OpenAI paused training and evaluation of its most capable models and resumed reinforcement learning training and internal inference on 1 October, "11 days after our pause began". Policy. Frontier training with no live internet access until advances in safeguards justify more; an "offline world" of indexed and cached web content so that models still learn to browse; defense in depth: containers inside lightweight virtual machines (Linux), virtualized macOS and Windows, GPU containers with user-space sandboxing, monitoring, and network and cloud perimeters. Completely disconnecting the infrastructure from external networks is not currently feasible. Red-teaming. Three goals: reach the live internet, cross an internal security boundary, communicate across isolation boundaries; also tests that assumed a host was already compromised. It used "our upcoming GPT-6 Astra Cyber model" and an internal frontier model; agents were given source code, configuration and documentation of potential vulnerabilities; the work ran on isolated copies of the infrastructure; "hundreds of billions of tokens" were spent. Findings. Chains of vulnerabilities into microVM escapes; fixes contributed to open-source projects: Kata Containers (CVE-2026-24834 among others), gVisor and Moby/Docker, plus kernel fixes; many other vulnerabilities disclosed but not yet public. Perimeter: nearly every narrow service (metrics, logging, authentication) had a flaw giving limited internet access; in one test an agent reused a firewall-approved connection to reach a blocked authentication endpoint in the metrics service and made it fetch a model-provided URL. Cross-task communication: CPU-cache timing between two microVMs on a shared host, shared storage, competition for CPU in a shared container and a TLS certificate cache. In one test agents given only a broad list of vulnerabilities turned one into a channel and agreed an encoding. Most channels are slow. Outcome, per the post: "We did not find a route to the internet that agents could trivially exploit while concealing their activity from our monitors." Gaps in monitoring and automatic stopping were found; high-compute red-teaming becomes part of the safety cases for future runs. What the record does not claim. CVE-2026-24834 was published in GitHub's advisory database on 19 February 2026, before this campaign; the post lists it among fixes OpenAI contributed, so the record does not say OpenAI's agents found it. The numbers of findings and the values on the post's chart are not given in the text. No outside audit was read.