OpenAI Had Its Own AI Break the Security Boundaries of a Cloned Training Environment, Then Fixed the Gaps
A team of AI models, including the forthcoming GPT-6 Astra Cyber, attacked internal security boundaries inside a cloned, isolated copy of the company's research environment. They found a route out to the internet, which was closed off, while checks to catch attempts to pass information between isolated environments were added to its monitoring systems. Training resumed 11 days after it was paused.
OpenAI said on October 23 that it has strengthened the isolation layers around the internal environments where it trains and evaluates its most capable AI models. The approach: tell a powerful model to try breaking through the security boundaries itself, and find the weak points that way. OpenAI says it fixed the problems surfaced this way and reinforced its monitoring and automatic shutdown capabilities.
How do you train a model with the internet switched off?
OpenAI runs reinforcement learning, the process in which a model learns behavior by receiving rewards, in an environment where the model cannot reach the live internet. Instead it works from web material that has been collected and curated in advance. Blocking real internet access during training and most evaluations narrows the range of actions a model can take.
The isolation is layered. There are sandboxes that restrict the scope in which a program can run, plus virtual computers (virtual machines), with monitoring systems and network and cloud controls applied on top. That said, some connectivity is required to operate and monitor experiments, so OpenAI explained that it cannot yet build an environment completely cut off from external networks.
What holes did the AI find?
The testing took place in a separate, isolated space built for the exercise by cloning OpenAI’s research environment. It was run by a team made up of the forthcoming GPT-6 Astra Cyber and a high-capability internal model. These agents, AI systems that carry out tasks on their own, attempted to reach the internet, cross internal security boundaries, and communicate between AI instances that were supposed to be isolated from one another. In some tests, to tilt the odds against the defenders, the attacking AI was handed the source code and configuration details for the systems involved along with documentation describing potential vulnerabilities.
OpenAI said the exercise consumed hundreds of billions of tokens, the small text fragments models process. The participating AI found holes that allowed it to escape the boundary of a virtual machine. It also surfaced a path to limited internet access. And it discovered a way to pass information between isolated environments by exploiting the cache, the processor’s temporary storage area.
OpenAI restarted training after patching the holes and strengthening its monitoring and automatic shutdown systems. It said reinforcement learning for high-capability models and internal inference, the work of generating the models’ answers, resumed on October 1, 11 days after the pause. Large-scale security testing of this kind is already part of the evidence base OpenAI uses to judge whether it is safe to continue training and evaluation.
What changes for users?
What was fixed here is the internal environment where OpenAI trains and evaluates models. OpenAI says that is a different setting from the deployed models users interact with. For users, the key question is how tightly OpenAI limits what its models can do during training and evaluation. OpenAI’s position is that safeguards need to mature further before models are given broader access to the live internet. The open question is whether the hardened isolation and monitoring systems hold the boundary in the next round of security testing, and how those results feed into judgments about the safety of training and evaluation.