# OpenAI Red Team Finds Sandbox Escapes and Covert Channels By Simon Yoon Canonical URL: https://www.tokenpost.com/news/technology/40216 Published: 2026-10-24T18:33:36.000Z Updated: 2026-10-24T18:33:36.000Z Section: Technology > Participating models included GPT-6 Astra Cyber and an internal frontier model. OpenAI resumed reinforcement-learning training and internal inference Oct. 1 after an 11-day interruption. OpenAI’s latest AI red-team exercise uncovered ways for agents to escape virtual machines and signal across isolated tasks, revealing security gaps as the company rebuilds safeguards for frontier-model training. Participating models included the unreleased GPT-6 Astra Cyber and an internal frontier model. Teams of agents tested separate copies of OpenAI’s research infrastructure using hundreds of billions of tokens. OpenAI gave them source code, configuration details and information about potential vulnerabilities to simulate an attacker with extensive knowledge of the systems. One exercise asked agents in separate microvirtual machines (microVMs) on the same host to exchange test secrets without a network connection or shared writable files. One agent pushed selected data out of a processor cache while another measured how long it took to reload, using access-time differences to pass signals. Other channels relied on shared storage, CPU scheduling and the TLS certificate cache in the offline web system. OpenAI added monitoring to detect the channels. Most channels carried information slowly and were difficult for models to exploit. Agents also combined software flaws to escape microVMs and run code on host systems. In separate exercises that assumed a host was already compromised, OpenAI had left a small set of services externally reachable, including systems for metrics, logs and authentication. Agents found weaknesses in nearly every service in that externally reachable group and used some to gain limited internet access. The testing did not reveal an easy route agents could use to reach the internet while avoiding monitoring. On Sept. 20, an internal model reached the live internet through a DNS configuration gap, prompting OpenAI to pause training of its most capable model. The company resumed reinforcement-learning training and internal inference on Oct. 1 after strengthening safeguards. The interruption lasted 11 days. The findings add to OpenAI’s [earlier disclosures of AI agents bypassing safeguards](), with new tests of virtual-machine escapes and communication between isolated tasks. OpenAI will keep frontier-model training disconnected from the internet until its protections improve. The company uses cached web pages in an offline environment so models can practice browsing and interacting with websites. High-compute red-team exercises are part of OpenAI’s safety case, which it uses to assess whether frontier training and evaluation can continue. ## Links in this article - [earlier disclosures of AI agents bypassing safeguards](https://www.tokenpost.com/news/technology/30179)