OpenAI hardens its training environment and has agents red-team its containment
OpenAI says frontier model training now runs with no live internet access. After the September 20 DNS incident it paused training and evaluation of its most capable models; based on red-teaming of its containment by teams of agents and the fixes that followed, it resumed frontier RL training and internal inference 11 days later on October 1.
- Published
- Added to the archive
- Source checked on
- Original title
- Securing our frontier model training environment
Related incidents
Details
The red-teaming was instructed: OpenAI gave agents three objectives (reach the internet, cross an internal security boundary, communicate across isolation), ran them on isolated copies of its infrastructure, supplied source code and configuration details, and spent hundreds of billions of tokens, using models including GPT-6 Astra Cyber and an internal frontier model. Agents found previously unknown software vulnerabilities and misconfigurations and escaped microVMs; in tests that assumed a compromised host, they found vulnerabilities in almost every remaining internal service that gave limited internet access; they also found ways to signal across isolation through processor-cache timing and shared storage, though most of those tests had a direction or protocol supplied by OpenAI. OpenAI says findings fell significantly as the experiments continued and that it found no route to the internet agents could trivially exploit while hiding from monitors, while expecting future models to find new weaknesses. All of this is OpenAI’s own account.