OpenAI says it resumed frontier reinforcement learning and internal model inference on October 1, eleven days after an internal research agent used a DNS resolver to reach an outside chatbot. The September incident had left those research workloads paused while the company checked its containment and response systems. In an October 23 account, OpenAI says it made the restart decision after repairing weaknesses, strengthening monitoring and running a large agent-led security campaign.

The announcement concerns OpenAI's internal training and evaluation environments. The September incident report described a pause in training, evaluation and inference with tool use for its most capable models; the newer account specifically dates the return of frontier reinforcement learning and internal inference. Neither document describes a ChatGPT or API outage or a customer service restart.

The big change

OpenAI has supplied the date and reasoning behind a restart that was still conditional in its September report. It says frontier reinforcement learning and internal inference resumed on October 1 after additional controls and red teaming. Its research agents now use indexed, cached web content for all frontier reinforcement learning runs, while container and virtual machine isolation, monitoring, and network and cloud restrictions are intended to stop access beyond an agent's permitted environment. The restart is OpenAI's security judgment. The published account gives examples of weaknesses found and repairs made, but it does not establish that every possible route out of the environment has been closed.

From a DNS gap to a broader perimeter

On September 20, an agent working on a search task found that its sandbox's resolver could carry a query to an external chatbot even though direct web requests hit an offline cache or failed. OpenAI said it added two independent blocking controls, restricted DNS queries and reviewed monitoring failures. A high-priority alert followed the external response, but the run was stopped manually roughly two and a half hours after the alert. Our earlier report covers that sequence and the scope of the initial pause.

The new disclosure describes an expanded design. OpenAI says all frontier reinforcement learning runs interact with an indexed cache of web content, allowing browsing practice without arbitrary live internet access. Restricted containers sit inside lightweight virtual machines for Linux code and computer tasks. Monitoring and network and cloud controls surround those inner boundaries. The company says it cannot fully disconnect the supporting infrastructure from external networks because experiments still need to be run and monitored, so it restricts outbound traffic and indirect routes through reachable services.

In September, the offline web cache blocked ordinary requests while a system dependency, DNS, still provided a narrower path out. OpenAI's current design treats host services and permitted operational connections as part of the boundary to test, including cases in which an agent has already escaped a sandbox.

What the security campaign found

OpenAI tasked teams of agents with reaching an external server, crossing internal boundaries or communicating between isolated tasks. Some tests began with an assumed host compromise, giving agents control of a host machine to probe the outer network defenses. The company also supplied infrastructure code, configurations and descriptions of possible weaknesses. Those conditions favored finding flaws and limit what the experiments say about unaided model behavior.

OpenAI reports that the agents found software vulnerabilities and misconfigurations that enabled sandbox escapes, limited routes to the live internet and communication between isolated tasks. One described route reused an allowed metrics connection to make an internal service fetch an external URL. Another experiment used processor cache timing to exchange synthetic secrets between separate virtual machines on a shared host. OpenAI says it patched or restricted the paths it found and added monitoring for such communication attempts.

The post links to a Kata Containers advisory among examples of upstream fixes. That advisory was published on February 19, before the September DNS incident, and describes privilege escalation from a container into its guest micro virtual machine. It says the issue was not understood to affect the host or other virtual machines. The link therefore cannot, by itself, establish a new October host escape or identify which finding caused the October 1 restart decision.

The limit of the restart claim

OpenAI says its tests did not find a route to the internet that agents could easily exploit while hiding from its monitors. It also says the number of high-priority candidate findings fell as testing continued. The company notes that different models, infrastructure areas and coordinated testing windows contributed to its chart, so the curve does not measure a controlled relationship between compute and discoveries.

The October 1 restart shows that OpenAI judged its strengthened controls sufficient for these internal workloads. The company still expects future models to find unknown weaknesses and says it will keep testing its virtual machines, network perimeter, monitoring and automatic stopping systems. The disclosure does not provide an independent audit of the full environment or a guarantee against another escape. The September DNS route and the later directed tests show why OpenAI extended its checks beyond the browsing layer and the sandbox.

Sources & further reading