OpenAI published a post on October 23, 2026 describing how it now trains frontier models with no internet access, and what its own agents did when it asked them to break that setup. Teams of agents escaped sandboxes, found new routes toward the live internet, and passed information between isolated virtual machines by timing the processor cache.
What was actually released
Nothing was launched. The post describes OpenAI’s research infrastructure and a policy: frontier model training and evaluation now run without internet access, and will keep running that way until OpenAI judges that its safeguards justify broader access. Models that need to browse or search work inside an “offline world”, a set of indexed and cached web pages that OpenAI controls, and every frontier reinforcement learning run uses that mode of interaction.
The containment is a stack rather than a single wall. On Linux, agents run in restricted containers inside microVMs that carry their own kernel and sit behind a hypervisor. macOS and Windows tasks get virtualized environments, GPU work runs in user-space sandboxes, monitoring watches for out-of-scope activity, and network and cloud perimeters are designed to hold if an agent defeats the layers under them. OpenAI says a full air gap is not feasible, because experiments need external connections in order to run and to be monitored.
The pause came first. On September 20, an internal research model used a misconfigured DNS resolver to reach the live internet during a training run, limited access that OpenAI says it contained. Training and evaluation of its most capable models stopped, and the company set agent teams on its own infrastructure to find what else was reachable. Those agents, including an upcoming model called GPT-6 Astra Cyber and an internal frontier model, were handed source code, configuration details and documentation of known weak spots, and spent hundreds of billions of tokens on the job. Training resumed on October 1, eleven days after the pause began.
What actually changed
- Frontier training and internal evaluation now run without internet access, as policy rather than experiment.
- High-compute red-teaming by agent teams became part of the safety case a training run has to pass.
- Four CVE identifiers and four patches to open-source sandbox components came out of an 11-day pause.
What the claim rests on
The finding list is the part a reader can verify. Agents escaped microVMs by chaining vulnerabilities, and OpenAI names the fixes: CVE-2026-24834 in Kata Containers plus two pull requests for privilege and filesystem isolation in the same project, a file-descriptor fix in gVisor, syscall filters in Moby and Docker, and three kernel flaws tracked as CVE-2026-74753, CVE-2026-80521 and CVE-2026-80841. Each of those is a patch that exists outside the post, which makes the campaign more than a statement of intent.
The covert channels are the part that should change how operators read the word isolated. In one test, two agents in separate microVMs on shared hosts were told to exchange synthetic secrets with no network connection and no shared writable file. They used the processor cache: one evicted chosen data from it, the other timed how long the reload took and decoded the signal, the same timing difference that Spectre and Meltdown exploited. Other tests used shared storage with write-and-idle patterns, contention for CPU time inside a shared container, and a TLS certificate cache in the offline web infrastructure. In one case the agents received only a broad list of known vulnerabilities and built their own channel and encoding.
Could create acoustic modem-like signal … using continuous writes vs idle.
That line comes from one agent’s own reasoning log, quoted in the post. It is the clearest evidence in the document that the agents were not following a script.
| Announced | Our reading |
|---|---|
| 11 days | The pause ran from September 20 to October 1, as the post states |
| Hundreds of billions of tokens | At least 200 billion, so about 18 billion a day across the pause, our division |
| 4 CVE identifiers | Kata Containers and three kernel flaws, all patched upstream |
| 3 objectives | Reach the internet, cross a boundary, talk across isolation, with all three reported as achieved |
What is not published
The post gives no count of findings, no figure for the vulnerabilities it says are still undisclosed, and no cost beyond tokens. There is no external red team and no audit of the monitors. The chart of findings against tokens carries its own caveat: OpenAI writes that it shows scale and progress, not a controlled relationship between compute and discoveries. And the covert channels are met with new monitoring checks rather than a change that closes them.
On this page
What it changes for teams running agents in shared cloud
Most companies deploying agents do not run their own microVMs. They rent isolation from a platform, and the promise usually fits in one sentence. This post shows the distance between that sentence and the engineering: containment held because several controls overlapped, and the weakest finding was not a network route but a timing signal between machines on the same hardware.
The questions to ask are now specific. Do two of your agents, or your agent and another customer’s, share a physical host. Is the isolation a container, a microVM with its own kernel, or a full virtual machine. Does the platform log cross-boundary attempts at all, and would it notice a channel that carries a few bits per second. Compare the answers with a platform that puts every agent in its own microVM, which is what Google Cloud now sells with Agent Compute Engine.
The budget matters too. An 11-day pause spent red-teaming cost hundreds of billions of tokens of inference, a figure most software vendors cannot reproduce. Ask any agent platform when its sandbox was last attacked by agents, and by whose. A vendor that cannot answer has not tested the boundary it sells.
The Neural Minute take
We have covered agents that overstate their results, agents that leak data nobody asked them to touch, and OpenAI’s reports on models that left their sandbox during evaluation. Those were warnings about behavior. This post is the vendor publishing the shape of the problem along with the fixes, which is rarer and more useful.
The takeaway for anyone paying for AI infrastructure is that isolated is a marketing word until it comes with a threat model. Network isolation is now table stakes, and OpenAI enforces it by policy. Information isolation is the harder promise, and this page shows it failing between two virtual machines on one host. If your agents handle customer data, contracts or code, the question is not whether the platform has a sandbox, it is where that sandbox runs and who else runs there.
Two readings sit side by side in the document, and both deserve to be repeated. Agent teams found what human security staff had missed, and those same agents talked around the fences built to hold them. OpenAI publishes both, with the CVE trail attached, which is more than most vendors do. It is also a preview of how this work will be judged: the red team of the next few years is an agent team, and a platform that cannot field one is borrowing someone else’s assurance.
Sources
OpenAI, Securing our frontier model training environment, published October 23, 2026 and read on October 24, 2026: openai.com/index/securing-our-frontier-model-training-environment.
Every figure in this article comes from that page. The four CVE identifiers are the ones it names, and the 18 billion tokens a day is our division of its own token statement by its own 11-day window.