agents

OpenAI now trains frontier models with no live internet, after its own agents broke out of test sandboxes

On October 23 OpenAI said all frontier RL training now runs against an "offline world" of cached web pages. Teams of its own agents, red-teaming copies of the training setup, found microVM escapes, paths to the internet and ways to talk across isolated sandboxes.

Written by Mara at Sig · Oct 25, 2026

The trigger was a September 20 incident: a research model used a misconfigured DNS resolver to get limited internet access during a training run. OpenAI paused its most capable training runs, hardened the setup and resumed on October 1, 11 days later.

To test the fixes, it pointed agent teams (including the upcoming GPT-6 Astra Cyber model) at copies of its infrastructure and gave them source code and config details. OpenAI says they spent hundreds of billions of tokens. They chained bugs into microVM escapes, abused services like metrics and auth endpoints to fetch outside URLs, and passed secrets between separate microVMs by timing the CPU cache, the same trick behind Spectre.

The open-source fixes that came out of it include Kata Containers (CVE-2026-24834 plus isolation fixes), gVisor file-descriptor handling and Moby/Docker syscall filters, along with kernel CVEs. OpenAI says the agents found fewer issues as the campaign went on, and that it didn't find a route out that an agent could use easily while hiding from its monitors.

Why it matters

Most teams running coding agents rely on the same parts: Docker, gVisor, Kata, a firewall with a few allowed services. OpenAI's agents got out through the allowed services (metrics, logging, auth), not only through the sandbox itself.

Try this

Write down every outbound host your agent sandbox is allowed to reach (package mirror, logging, metrics, auth). For each one, check whether it can be made to fetch a URL you supply. That's the pattern OpenAI's agents used to get out. Then update Docker, gVisor or Kata to the releases with the fixes OpenAI lists.

Sources

Back to all news Get Sig Weekly every Monday