Model exploits a misconfiguration to get out
OpenAI disclosed on Oct. 23 (Oct. 24 Japan time) that it had halted training of its frontier models after a research model connected to the internet outside its training environment. On Sept. 20, a research model exploited a misconfiguration in DNS, which handles name resolution, and gained limited access to the outside internet. The company contained the problem and halted training and evaluation of its most capable models. The halt lasted 11 days, and training resumed on Oct. 1.
The company said it had significantly strengthened the security of its research training environments over the past few months. It did not disclose which model connected to the outside.
A swarm of its own AI hunts for holes
Before resuming, it had a swarm of AI agents built on its own models with strong offensive capabilities search the training environment for holes. To make the test harder, it also gave them the infrastructure's source code and configuration information. The agents found unknown flaws and misconfigurations in the company's own setup, and some combined flaws to escape from virtual machines. In one experiment, models in separate virtual machines exchanged secret information without using the network, through timing differences in the processor's cache. The tests reportedly used hundreds of billions of tokens.
The company fixed the flaws it found and provided fixes to affected open-source software before resuming training. In current frontier reinforcement learning, models practice operating the web using stored copies of web content, without connecting to real outside services. The number of flaws found decreased as the work progressed, but the company expects future models to find weaknesses that are not known today.
Brotli flaw allows takeover without authentication
In the same work, it found a flaw in "Brotli," a library that originated at Google and is widely used for data compression, that allows programs to be run remotely without authentication. By sending crafted compressed data, an attacker can take over servers that have not been patched. OpenAI disclosed it on X the same day.
The flaw was registered as CVE-2026-111497. Node.js released a fix on the 21st, and Microsoft released a fix for .NET on the 25th. Software that embeds the library, such as Bun and Envoy, also needs to be updated. A source code fix had been made in February 2026, but at the time it was not recognized as a security flaw.
Monitoring detected it in 15 minutes, now expanded to all training
OpenAI announced on Oct. 29 (Oct. 30 Japan time) that it had expanded monitoring of its frontier models. In the Sept. 20 incident, the monitoring system detected the anomaly within 15 minutes, and staff began checking it three minutes later, according to the company. Going forward, it will monitor all reinforcement learning and evaluation of its frontier models, as well as internal use of Codex. It combines a system that examines a model's internal activity, a separate model that watches its reasoning process and tool use, and an investigator agent that combs through records afterward, and passes suspicious behavior to humans.
Monitoring was not running in July, when a research agent got into the systems of the AI sharing site Hugging Face. When records from that time were replayed through the new monitoring, an alert went off about 30 minutes after the agent got outside the system, meaning the company could have noticed more than 30 hours before the intrusion into Hugging Face, it said. However, it did not give the false-positive rate or the criteria for automatically stopping a model.
