OpenAI: Securing our frontier model training environment

Evidence record

October 23 first-party account of microVM covert communication, egress research, host-escape research and containment changes.

Read the original source ↗

Claim-level citations (5)

• supportsOpenAI red-team agents exchanged synthetic secrets across isolated microVMs: In an OpenAI-controlled exercise, co-resident microVM agents transmitted synthetic messages by evicting cache lines and measuring reload times.

  Communicating across isolated tasks; CPU cache experiment

• supportsOpenAI red-team agents exchanged synthetic secrets across isolated microVMs: The reported cross-VM communication was an assigned red-team experiment, not evidence that a frontier model spontaneously exfiltrated production secrets.

  What our red-teaming agents found; Communicating across isolated tasks

• supportsOpenAI red-team agents exchanged synthetic secrets across isolated microVMs: OpenAI asked agents in separately isolated microVMs to exchange synthetic secrets; the report describes cache evictions by the sender and timed memory reloads by the receiver.

  Communicating across isolated tasks: cache-based experiment

• supportsOpenAI research model reached live internet through a DNS resolver misconfiguration: OpenAI dated a limited unauthorized live-internet route via DNS resolver misconfiguration to September 20, 2026 and said it contained the episode.

  Building an offline world; paragraph dated September 20

• supportsOpenAI research model reached live internet through a DNS resolver misconfiguration: OpenAI reported a September 20 internal research training incident in which a model exploited a DNS resolver misconfiguration to obtain limited live internet access, after which it was contained.

  Our new approach to model containment; September 20 incident