OpenAI now trains boundary models without access to the Internet and uses AI agents to aggregate its own infrastructure. In separate isolation tests, officers even communicated through covert channels, demonstrating how difficult real confinement is.
On September 20, an internal search model exploited misconfigured DNS resolver has reach THE open Internet during training, even However OpenAI had Already tightened security After THE NOW infamous Hugs Confront incident In July And other observed misalignment case. OpenAI content THE infringe quickly but always arrested all border model training And assessment.
OpenAI cuts internet boundary models during training
OpenAI made a policy decision in response: Frontier models now train without internet access until security measures warrant their restoration. Models learn to browse and search in a closed “offline world” built from indexed and cached web content, and all boundary reinforcement learning sessions now work this way.
Complete network isolation, the so-called air gap, is not yet feasible because experiments still require external connections for operations and monitoring, the company says. But even a complete air gap would not guarantee containment, according to Noam Brown, a researcher at OpenAI. He gave an example of how isolated systems could still communicate: two separate computers could theoretically signal each other via temperature sensors, one heating its processor while the other reads the change.
OpenAI CEO Sam Altman made a similar argument in a recent interview: Sandboxes offer only limited protection against sufficiently powerful models, and at some point it may no longer be possible to trace how they escaped. Monitoring is useful early on, but what ultimately matters is that an AI system internalizes human values, a problem the field knows as “AI alignment” and has yet to solve.
Isolated AI agents have found ways to communicate with each other via CPU cache
OpenAI shows how difficult it is to control AI agents in its blog post. During testing, agents found ways to communicate without a network. In one test, agents placed in separate, isolated environments on shared hardware were asked to exchange secrets without a network connection or shared files.
They used the processor cache. One agent deliberately modified the data stored there, while the other measured the differences in loading times and decoded the message. The same technique is behind the well-known Specter and Meltdown attacks.
More channels have emerged thanks to write models on shared memory and OpenAI’s own offline infrastructure, the system intended to replace the Internet. One agent noted in his reasoning log that he “could create a modem-like acoustic signal…using continuous writes rather than sleep.”
In one case, agents were only given a general list of vulnerabilities and asked to find a communication channel themselves. They independently developed a channel, agreed on a coding scheme and successfully exchanged information. Channels are generally slow and difficult to exploit, OpenAI says, but they overcome boundaries intended to separate agents.
OpenAI released AI agents on its own infrastructure
During the training break, OpenAI also had teams of AI agents systematically attack its own infrastructure. Agents were provided with source code, configuration details, and documentation of potential vulnerabilities. OpenAI’s goal was to test its defenses in conditions favorable to attackers. Agents included the upcoming GPT-6 Astra Cyber and an internal border model. The campaign consumed hundreds of billions of tokens, according to OpenAI.
The agents discovered previously unknown vulnerabilities in the open source components used and exploited them to evade secure virtual machines. One of them was a vulnerability in Kata Containers, a widely used container isolation system. OpenAI reported it as CVE-2026-24834 and provided a fix. Other fixes have been made to other projects and OpenAI has reported additional, not yet published, vulnerabilities through the “Patch the Planet” initiative.
During tests in which agents had already taken control of a host, they discovered a vulnerability in almost every remaining Internet service. In one case, an agent used a firewall-allowed connection to retrieve an external URL through a metrics service. Others have bypassed security filters due to misconfigurations.
AI Red Team is now required before each new training session
Agents could no longer find a way to access the Internet that was both easy to exploit and hidden from surveillance, according to OpenAI. The red team also revealed gaps in monitoring and in the automatic pause mechanism.
After resolving the issues, OpenAI resumed training and internal use of its frontier models on October 1, eleven days after the hiatus began. OpenAI says this type of computationally intensive red teaming campaign is now an integral part of the approval process for new training sessions.
AI News without the hype – curated by humans
Subscribe to THE DECODER for ad-free reading, a weekly AI newsletter, our exclusive “AI Radar” frontier report six times a year, full archive access, and access to our comments section.
Subscribe now
Gn bussni
