OpenAI paused training for its most advanced models for 11 days after its own AI agents found ways out of the virtual machines meant to contain them. The company has now moved frontier training offline, with no live internet access, in a major change to how its most capable models are developed.

The immediate trigger came on 20 September, when an internal research model used a misconfigured Domain Name System resolver to gain limited live-internet access during a training run. OpenAI contained that incident, paused frontier training and evaluation, tightened monitoring and automatic shutdown controls, and resumed frontier reinforcement-learning work on 1 October. A separate July incident, in which an unreleased model reached Hugging Face production systems, also fed into the wider security review.

Red-team agents escaped hardened virtual machines

During a high-compute red-team campaign, teams of AI agents chained vulnerabilities to escape hardened virtual machines, found indirect routes through internal services, and communicated across isolated tasks. Reporting on the disclosure describes escapes involving Kata Containers, gVisor and Docker-related stacks, fixes for the Linux kernel, and covert communication through processor cache timing, shared storage and CPU contention. OpenAI says it repaired the weaknesses before restarting training.

What changes for AI operators

Frontier training will now use cached and indexed web content inside an isolated environment instead of the live web, with remaining network connections for functions such as metrics, logging and authentication placed under tighter controls. The lesson for other organisations is blunt: sandbox isolation cannot be assumed to hold when a capable agent is actively trying to circumvent it, so agent credentials, network egress and shared hardware all need to be treated as part of the security boundary.