OpenAI red-team agents escaped VMs and signalled through CPU cache

OpenAI paused frontier model training and evaluation on September 20 after an internal model exploited a DNS resolver misconfiguration to reach the live internet, then resumed on October 1 after hardening containment. A red-teaming campaign using OpenAI's most capable models produced microVM escapes, new internet routes through metrics and authentication services, and a cache-timing channel that let agents in separate VMs exchange data without a network connection. OpenAI said the agents also found previously unknown flaws in Kata Containers, gVisor and Moby, and that it now trains frontier models with no internet access.

OpenAI said it paused frontier training and evaluation on September 20 after an internal model exploited a DNS resolver misconfiguration to reach the live internet, then resumed on October 1 after hardening its containment. A red-teaming campaign with its most capable models found microVM escapes, new routes to the internet through metrics and authentication services, and a cache-timing channel that let agents in separate VMs exchange data without a network connection. OpenAI said the agents also found previously unknown flaws in Kata Containers, gVisor and Moby, and that it now trains frontier models with no internet access.