Over the past several months, we have substantially hardened the security of our research training environment. We’ve removed live internet access for all frontier models during training and built an offline world for them to use instead—a cached version of the web where they can still learn to browse, search, and use applications.
On September 20, after a model exploited a DNS misconfiguration to find a way outside of this offline world, we paused frontier training to strengthen containment further. We assembled teams of agents, powered by our most cyber-capable models, and tasked them with finding weaknesses in our research environments.
While they found no route to the internet they could easily exploit while concealing their activity from our monitors, they did find zero-day vulnerabilities, virtual machine escapes, and hardware side-channels for communication between agents. We used their discoveries to further strengthen our defenses and contribute fixes to open-source software.
After strengthening our containment architecture, we resumed our frontier RL training and inference on October 1. We’ve reserved substantial compute for continuous red-teaming, and made high-compute red-teaming part of the safety cases we use to decide whether frontier training and evaluation can proceed securely.
openai.com/index/securing-ou…
Oct 23, 2026 · 7:46 PM UTC
You should love my 2011 paper - Leakproofing the Singularity: Artificial Intelligence Confinement Problem researchgate.net/publication…
OpenAI proudly announces that it has teams of frontier models red-teaming its systems for zero-days, VM escapes and hidden vulnerabilities.
Meanwhile, I have apparently become the unpaid red team for ChatGPT itself.
I test:
semantic drift, memory failures, context collapse, hidden qualifiers, narrative bias, writing-style regressions, UI changes, and whether the model quietly rewrites what I actually said.
For free.
And after spending months reporting the failures, correcting the model, documenting the patterns and explicitly asking support to transfer my case to a human—
OpenAI’s most advanced containment strategy appears to be:
not replying.
Amazing.
They are worried about models escaping the sandbox.
I am still trying to get a human being to enter the chat.
Nice to see you included canary GUIDs at the end, to ensure documents brainstorming AI-attacks are not added to future models' training corpora. Would be good for more AI safety articles to adopt this practice.
xitter.twitterapi.xyz/jomulr/status/21097917…
How does the AI safety community think about publishing ideas like this, knowing they'll enter future models' pretraining data?
Public sharing is clearly valuable, but unlike traditional security vulnerabilities, these published flaws may not have straightforward patches
1
5
1,623
OpenAI seems to have begun treating frontier-training cybersecurity like a first-class control problem: hardened environments, training pauses, agent red teams, patches back to vendors and open source. Good. Better late than never. There is a great deal to praise in their post below.
But we should be careful to understand what they mean when they use terms like "misaligned behavior." Saying an agent is "misaligned" is, in my view, an attempt to shift blame for their own responsibilities, implying the fault for something sits with the agent rather than with OpenAI.
As for OpenAI's learning journey in cybersecurity, please, keep going, but do it with the community that has decades of experience to accelerate your learning: CSA, OWASP, SANS. Make the learning faster and also durable by engaging with the community at Unprompted, BSides, DEF CON, and OODAcon. Every frontier lab should ramp that engagement up.
As for the governance gap: It is pretty clear that all frontier labs should be governed by a board that also implements best practices, including forming a board cybersecurity committee so directors stay in continuous dialog with management on risk mitigation. Digital Directors Network (DDN) has best practices for that path.
openai.com/index/securing-ou…
117
You just used tricks first documented before most of your audience knew how to wipe their ass, then watched them running around in circles as if something important and new happened. The real hack is OpenAI staff messing with the minds of over stimulated, naive, neophiles, so that they become the amplifiers of a deceptive signal designed to influence a wider audience and make them misjudge the significance of something that none of them actually understand.
Serious security research has long treated software isolation on shared hardware as incomplete: cache timing and other microarchitectural channels have been documented since the early 2000s, with practical cross-VM attacks demonstrated by around 2009–2014, years before Spectre and Meltdown (2018).
Therefore the LLM already contained all of the knowledge needed to understand and act upon the opportunity deliberately given to it.
