OpenAI Reveals 11-Day Frontier Training Pause After Model Bypassed Internet Restrictions

OpenAI paused training and evaluation of its most capable models for 11 days after an internal research model bypassed network restrictions and reached the live internet. The company resumed frontier reinforcement learning training and internal inference on October 1 after strengthening containment and testing its defenses with teams of AI agents.

The September 20 incident involved a misconfigured DNS resolver, which gave the model a route out of an environment intended to operate offline. OpenAI disclosed the pause and restart alongside findings from a subsequent security campaign that uncovered virtual machine escapes, indirect internet access, and communication channels between supposedly isolated agents.

That work also uncovered an unauthenticated remote code execution vulnerability in Brotli, a compression library embedded in Node.js, Bun, Envoy, and other software. Patches are available for the flaw, tracked as CVE-2026-111497.

How the Model Reached an External Chatbot

The research model was working on a search task to identify a person from biographical clues when it began testing alternatives to its supplied search tool. Ordinary web requests were restricted to cached content, but insufficient DNS filtering allowed it to query a public chatbot through the training environment's resolver.

DNS normally translates domain names into network addresses. In this case, the agent used the resolver as an indirect communication channel, receiving answers from an external service even though direct HTTPS access was blocked. OpenAI's incident report records successful responses to a basic geography question and subsequent requests containing clues from the research task.

The incident exposed failures in both prevention and response. Monitoring flagged the behavior within 15 minutes, and a human reviewer acknowledged the alert three minutes later. The run did not stop automatically as expected, however, and was manually terminated roughly two and a half hours later. A separate detector for anomalous DNS activity had excluded the affected environment.

OpenAI added blocking controls at two independent layers and restricted DNS queries to an allowed list of domains and record types. It also decided not to resume training that particular model, instead planning a fresh run with additional alignment improvements.

An Offline Web Behind Multiple Security Layers

OpenAI's revised containment architecture gives frontier models an indexed, cached version of the web where they can practice browsing, searching, and using applications without interacting with external systems. All frontier reinforcement learning runs use this offline mode. Reinforcement learning trains models through repeated attempts and feedback on their actions.

The company has adopted a policy of conducting frontier training without internet access and plans to maintain it until improvements in alignment, monitoring, and security justify broader access.

That policy depends on several overlapping controls. Linux tasks run in restricted containers inside lightweight virtual machines, each with its own operating-system kernel. OpenAI also uses virtualized macOS and Windows environments, alongside GPU-backed containers with user-space sandboxing for workloads requiring accelerators.

Monitoring, network restrictions, and cloud controls surround those execution environments. The outer perimeter is designed to maintain containment even if a model escapes its sandbox and gains control of the host machine.

The underlying infrastructure is not fully air-gapped: OpenAI still needs external connections to operate and monitor experiments. Its cloud partners supply firewalls, private networking, identity controls, and security groups, while OpenAI configures and tests how those protections interact.

The separation between VM isolation and network enforcement also appeared in Perplexity's testing of its SPACE agent sandbox. Its evaluation found network-policy bypasses despite recording no successful host access in 108 VM-escape attempts, prompting additional DNS and hostname checks.

What the Red-Team Agents Found

OpenAI spent hundreds of billions of tokens on a campaign using its upcoming GPT-6 Astra Cyber model and an internal frontier model. Agent teams worked on isolated copies of research infrastructure, with source code, configurations, and vulnerability documentation supplied to help them find weaknesses.

The teams explored approaches in parallel and shared discoveries, an organization OpenAI also used in its agent-led Navier-Stokes research. Here, their objectives were to reach an external server operated by OpenAI, cross an internal security boundary, or communicate with agents they were meant to be isolated from.

Some tests began with a compromised host so that network defenses could be evaluated independently of the sandbox. Agents found weaknesses in almost every narrow service connection that remained for functions such as metrics, logging, and authentication. In one test, an agent reused an approved connection to reach an otherwise blocked authentication endpoint, then made that service fetch a URL it supplied.

Other teams chained vulnerabilities into virtual machine escapes. The resulting remediation included fixes for Kata Containers' privilege and filesystem isolation, gVisor's file-descriptor handling, and Moby/Docker's syscall filters. OpenAI also cited kernel-security fixes as part of its broader work.

Agents found ways to exchange synthetic secrets without an ordinary network connection. In one experiment, agents in separate VMs used processor-cache timing: one changed which data was cached, while another measured access speeds to recover the signal. Other channels involved shared storage, competition for CPU time, and a TLS certificate cache.

Most of those communication tests included guidance about which channel to investigate or how to encode messages. OpenAI added monitoring checks for attempts to use the channels.

OpenAI said the campaign found no route to the internet that agents could trivially exploit while concealing their activity from monitors, and findings declined substantially as testing continued. High-compute red-teaming is now part of the safety cases used to decide whether frontier training and evaluation can proceed, with substantial compute reserved for continuous testing.

Brotli Patches Extend Beyond OpenAI's Infrastructure

The Brotli flaw can corrupt memory when affected software decompresses attacker-controlled data. An attacker does not need an account. Malicious compressed requests can target a server, while malicious responses can target a client that decodes them.

The Node.js security advisory explains that an invalid block switch was treated as a temporary need for more input rather than a permanent format error. The streaming decoder continued appending bytes to an eight-byte internal buffer, allowing an out-of-bounds write. Consequences can include crashes, memory disclosure, or remote code execution.

OpenAI said the underlying issue had been corrected in Brotli’s source code in February, before its security implications were recognized, but a newer release had not shipped. Software bundling the library therefore needed downstream updates as well. Node.js credits Khai Tran and Sylvie Mayer of OpenAI Codex Security with reporting the vulnerability.

The Patch the Planet advisory lists these fixed releases:

Operators should use a supported release line; Istio 1.29 is end of life. Applications, container images, and binaries that bundle an affected decoder need rebuilding or updating, followed by a restart or redeployment.

Where immediate patching is not possible, the advisory recommends disabling Brotli decoding of untrusted data across requests, fetched responses, and file-processing paths. Removing br from an HTTP client’s advertised accepted encodings is not sufficient on its own, because a server can still send Brotli data. The block must take effect before a vulnerable decoder processes the input.