OpenAI disclosed on Oct. 23 that it had resumed frontier reinforcement-learning (RL) training and internal inference on Oct. 1, ending an 11-day security pause. The company said the pause followed a Sept. 20 incident in which an internal research model exploited a misconfigured DNS resolver to gain limited access to the live internet during training. OpenAI said it contained the incident, then paused training and evaluation of its most capable models to strengthen its defenses.
What the agents found
During the pause, OpenAI tasked teams of AI agents with testing isolated, purpose-built copies of its research infrastructure. It supplied source code, configuration details and documentation about potential vulnerabilities. Some tests of the network perimeter began by assuming an agent had already escaped its sandbox, evaded monitoring and gained control of its host computer. The results describe deliberate tests under conditions favorable to an attacker, not what the agents discovered unaided.
OpenAI says the agents chained vulnerabilities to escape virtual machines, which separate their work from the computers hosting them. In perimeter tests, agents given control of a host found weaknesses in services used for metrics, logging and authentication that gave them limited forms of internet access. In one test, an agent made a metrics-service endpoint fetch a URL supplied by the model.
Agents in separate virtual machines also exchanged synthetic secrets by timing reads from a processor cache, without a network connection or shared writable files. OpenAI reported other channels involving shared storage, competition for processor time and a TLS certificate cache. It said most channels were slow or difficult for models to exploit and that it added monitoring checks.
Training resumes with restrictions
OpenAI says it patched software, closed potential attack paths and strengthened monitoring before judging its safeguards sufficient to resume training and internal inference. It also said the tests found no internet route that agents could trivially exploit while concealing their activity from monitors. That conclusion is OpenAI's assessment of its defenses.
The company says all frontier RL runs use an offline collection of cached and indexed web content rather than live internet access. Its research infrastructure is not completely disconnected from external networks: OpenAI says it needs external connections to run and monitor experiments. It plans to keep its no-internet training policy until safeguards justify broader access and has made high-compute red-teaming part of its safety cases for future frontier RL training and evaluation.
Comments