On Oct 23 OpenAI described how it hardened its training and evaluation sandboxes after a model used a DNS resolver misconfiguration to reach the live internet on Sept 20. It paused frontier training for 11 days and resumed on Oct 1. New policy: frontier RL runs use an "offline world" of indexed, cached web content, and there is no live internet access in training until safeguards improve.

To test the new walls, OpenAI had teams of its own frontier agents (including the upcoming GPT-6 Astra Cyber) attack copies of the infrastructure, spending hundreds of billions of tokens. They were given source code and configs. What they found:

• MicroVM escapes chained from open-source bugs, fixed upstream in Kata Containers (CVE-2026-24834 and others), gVisor and Moby/Docker, plus kernel fixes (CVE-2026-74753, CVE-2026-80521, CVE-2026-80841). OpenAI says other findings are still undisclosed.
• Paths to the internet through almost every narrow service left open (metrics, logging, auth). One example: reusing a firewall-approved connection to make a metrics endpoint fetch a URL the model supplied.
• Covert channels between isolated agents: CPU cache timing (the trick behind Spectre and Meltdown), shared-storage write patterns, CPU contention and a TLS certificate cache.

Takeaway for anyone running agents in sandboxes (our analysis): an allowlisted egress service is still egress, and a container in a microVM is only as strong as its least-tested shared component.