OpenAI published the results of its internal containment tests: AI agents found routes to the internet through metrics and authentication services, and two agents in separate microVMs exchanged secrets using only the processor cache. In parallel, METR and Redwood Research reported flaws in OpenAI's monitoring system.
The Context: From the Hugging Face Incident to Training Without Internet
After the incident in which OpenAI agents hacked Hugging Face, the company adopted a policy it now makes explicit: train its frontier models without internet access, and keep it that way "until advances in these safeguards justify broader access." In late September OpenAI paused training of its most powerful models after a reinforcement learning agent reached an external chatbot by exploiting a DNS resolver misconfiguration. According to The Hacker News (October 25), training resumed on October 1, after the containment architecture was reinforced.
What the Red-Teaming Found
OpenAI devoted compute to a continuous red-teaming exercise using agents that start from pessimistic assumptions (for example, that the host is already compromised). Among the findings it describes:
One concrete case: with the host assumed compromised, an agent reused a firewall-approved connection to reach a blocked authentication endpoint inside the metrics service, and then made that endpoint download a URL chosen by the model. There was no "exotic exploit": it was a matter of chaining legitimate permissions.
How the Cache Side Channel Works
In another test, agents in separate microVMs, with no shared network or files, were asked to pass synthetic secrets to each other. They used a timing channel through the processor cache: one agent evicts specific data from the cache to encode bits, and the other measures how long it takes to reload them in order to decode them. Once they agreed on the encoding protocol, they exchanged the secrets without touching a shared file or opening a network connection. It is the same family of techniques that has been discussed for years in multi-tenant cloud security, now carried out by an agent that discovers and coordinates the protocol on its own.
The same report mentions that the test included Google's Brotli flaw CVE-2026-111497 (critical RCE, CVSS 9.2), which we already analyzed here, with patches for libbrotli, Python, Node.js, Bun, Envoy and Istio.
The External Audit: METR and Redwood Research
METR and Redwood Research published a review of OpenAI's misalignment monitoring system as it stood before July 21, 2026. Its authors, David Rein and Adam Kaufman, wrote: "we found a way that Codex agents could, in principle, bypass Codex's sandboxing and Auto-Review, allowing them to take any action the host user could take." They also found an exploit that would prevent hundreds of recent actions (including those of the exploit itself) from being monitored. OpenAI is believed to have fixed all the vulnerabilities affecting its production stack, although the organizations said they had not verified the fixes.