OpenAI says isolated agents signal via CPU cache

OpenAI said an internal research model reached the open internet on 20 September after a DNS resolver was misconfigured. The company said it then stopped frontier training and changed its setup so its most advanced models train in an offline environment built from cached and indexed web material. It said all frontier reinforcement learning now uses that arrangement.

OpenAI also said it could not yet run experiments in a fully disconnected setting because some external links were still needed for operations and monitoring. Noam Brown, an OpenAI researcher, said even a complete air gap would not guarantee containment. He gave temperature sensors as one possible route for two machines to exchange signals.

In separate tests, OpenAI placed agents in isolated systems on shared hardware and asked them to pass secrets without network access or shared files. The company said they used processor cache timing, and that other channels also appeared through shared memory write patterns and its offline infrastructure. One agent noted that it could form an acoustic-modem-like signal using patterns of writing and inactivity.

During an 11-day pause, OpenAI also used AI agents to attack its own systems with source code, configuration data and vulnerability notes. The campaign included GPT-6 Astra Cyber and an internal frontier model, and OpenAI said it consumed hundreds of billions of tokens. The agents found previously unknown flaws in open-source components, including one in Kata Containers, which OpenAI reported as CVE-2026-24834.

OpenAI said the agents later found a flaw in nearly every remaining service exposed to the internet once they had host access. It said some paths used firewall-permitted connections or configuration mistakes. After fixes, the company resumed training on 1 October and said this red-teaming is now required before new training runs.