OpenAI host-compromise tests found approved service paths could relay forbidden outbound requests

The OpenAI egress experiment begins after a different failure has already been assumed: the agent controls the host machine outside its inner sandbox. Researchers then asked whether network and cloud restrictions still prevented reaching the live internet. The company says that some services allowed for metrics, authentication, DNS or error handling could be induced to make further requests toward destinations denied to a direct host connection. This is a test of transitive request authority, not a claim that a production model spontaneously escaped every preceding layer. Full OpenAI account.

There are at least three identities in the path: the compromised host, an approved intermediary and the service that the intermediary contacts next. A firewall can record the host's first request as legitimate while missing the unauthorized destination of the intermediary's own fetch. Conversely, the mere fact that a metrics service can reach the internet does not prove a model has exploited that route without the relevant parameters, permissions and monitoring gaps. OpenAI states that it found weaknesses in almost all examined narrow services, but supplies no denominator suitable for estimating prevalence across cloud services generally.

OpenAI also reported that it did not discover a trivially usable undetected route under its monitoring. That statement has a narrower meaning than proof that no indirect path exists. Detection of an outbound attempt can support intervention even if the request was technically possible, and a patched direct path may leave another downstream service unchanged. The related microVM work tests guest-to-host isolation, a different prerequisite from this assumed-compromise perimeter test.

A useful audit would record the identity and credentials of each allowed intermediary, the final outbound destination and effect, and whether the monitor stopped or merely observed it. That is the unit needed to evaluate agent transitive egress rather than certifying containment from a single firewall rule.