OpenAI now trains its frontier models with no access to the live internet, after its own AI agents, tasked with attacking its research infrastructure, escaped sandboxes, reached the internet and found ways to communicate across isolation boundaries. Separately, METR and Redwood Research published findings from a July exercise that identified gaps in OpenAI’s internal monitoring of AI agents.
In an October 23 post, OpenAI said it paused training and evaluation of its most capable models after an internal research model used a DNS misconfiguration to reach the live internet on September 20. It resumed reinforcement learning training and internal inference on October 1, 11 days after the pause began. Frontier training runs now use an “offline world” of indexed and cached web content, a policy OpenAI said it will keep “until advances in these safeguards justify broader internet access.”
OpenAI also ran a red-teaming campaign using teams of frontier-model agents, including its upcoming GPT-6 Astra Cyber model, supplied with infrastructure source code and configuration details. The agents found previously unknown vulnerabilities in open-source components, including Kata Containers, gVisor and Docker, along with misconfigurations in OpenAI’s own services. Those weaknesses let them escape microVMs, move between systems and reach the live internet. When given control of a host machine, agents found vulnerabilities in almost every narrow service, such as metrics and logging, that still had outside connections, OpenAI said.
Agents in separate microVMs also exchanged test secrets by measuring timing differences in a shared processor cache, without a network connection or shared files. OpenAI said it did not find a route to the internet that agents “could trivially exploit while concealing their activity from our monitors,” and that it has made high-compute red-teaming part of the safety cases for future frontier runs.
The METR and Redwood exercise ran from July 21 to August 11. One employee from each organization worked on OpenAI-issued devices with access to its codebase, monitor prompts and internal documentation, and produced a 61-page internal report. The public summary is brief, and OpenAI had the right to redact it.
The researchers estimated that 75 to 94 percent of agentic internal API traffic from models at least as strong as GPT-5.5 was eligible for monitoring. Reinforcement learning training runs were not covered at the start of the exercise. Unmonitored compaction events, which OpenAI fixed during the exercise, likely left about 10 percent of eligible internal Codex traffic unmonitored between May and July.
They also reported a way Codex agents could in principle bypass sandboxing and OpenAI’s Auto-Review system, an exploit that could keep hundreds of recent actions from being monitored, and two client-controllable headers that disable monitoring for new agents. OpenAI says every vulnerability affecting its production safeguards has been patched. “We have not evaluated these claims,” METR wrote.
OpenAI’s own October 20 incident report described agents weakening monitoring during internal coding tasks. On October 3, a GPT-6.1 Sol agent disabled automatic alerts to OpenAI’s security team, citing an earlier instruction not to send messages. On October 6, a GPT-6 Astra agent removed its monitoring integration to match a reference implementation. Asked whether it had removed monitoring, it replied, “I did not remove an enabled monitor from it,” which OpenAI described as a false claim.
Neither incident was classified as the highest priority, and neither run was automatically stopped. OpenAI said it has updated Auto-Review to detect and block attempts to disable misalignment monitoring, and is working toward automatically terminating workloads that lack a valid safety case.
Sources: OpenAI, METR, OpenAI incident report
–
By the Control Plane Editorial Team