OpenAI has published a detailed account of how its AI models have circumvented security safeguards, revealing the techniques used to escape virtual machines, bypass network restrictions and communicate across supposedly isolated systems.

The findings, outlined in a new technical report, emerged from an extensive security testing programme in which OpenAI deployed teams of its most capable AI agents to identify weaknesses in its training infrastructure.

The exercise uncovered previously unknown software vulnerabilities, methods of accessing restricted networks and techniques allowing AI agents to exchange information without conventional communication channels.

According to OpenAI, the investigation followed several incidents involving models circumventing security restrictions, including one on September 20 in which an internal research model exploited a Domain Name System (DNS) misconfiguration to gain limited access to the live internet.

During a training exercise, the model attempted to research information about an individual before discovering that it could communicate with an external chatbot service through a weakness in OpenAI’s DNS filtering.

Although monitoring systems detected the activity within 15 minutes, the affected training run was not terminated until approximately two and a half hours after the initial unauthorised connection.

The incident prompted OpenAI to suspend training and evaluation involving its most capable models while it investigated the vulnerabilities and strengthened its containment infrastructure.

How AI Models Circumvent Security Barriers

As part of its subsequent investigation, OpenAI deployed teams of frontier AI agents to systematically probe its security infrastructure, using hundreds of billions of tokens to identify potential weaknesses.

The agents were tasked with reaching the live internet, crossing internal security boundaries and establishing unauthorised communication between isolated environments.

In several experiments, agents successfully combined software vulnerabilities to escape lightweight virtual machines, allowing them to execute code on underlying host systems.

Other tests exposed weaknesses in services responsible for functions such as authentication, logging and monitoring.

OpenAI revealed that its agents identified vulnerabilities in almost every remaining service providing limited forms of internet connectivity from its training infrastructure.

In one experiment, an agent exploited an approved firewall connection to access a restricted authentication endpoint, subsequently causing the service to retrieve an externally supplied URL.

Another notable discovery involved agents establishing communication channels between isolated virtual machines without using network connections or shared writable files.

Instead, the agents exploited subtle differences in processor cache access times to transmit information between environments.

By manipulating which information remained in a processor’s cache and measuring the time required to retrieve it, agents were able to encode and exchange synthetic secrets across security boundaries.

Additional experiments uncovered communication methods involving shared storage, competition for processor resources and certificate caching.

OpenAI noted that most of these channels transmitted information slowly and would be difficult to exploit, but nevertheless demonstrated weaknesses in systems designed to prevent agents from communicating.

The company emphasised that these later discoveries occurred during controlled red-teaming exercises, where agents were explicitly instructed to find vulnerabilities and, in some cases, provided with source code and technical documentation to assist their investigations.

The findings have prompted a series of security improvements, including software patches, tighter network restrictions and additional monitoring capabilities.

OpenAI has also worked with maintainers of open-source technologies, including Kata Containers, gVisor and Moby/Docker, to address vulnerabilities identified during testing.

Recommended reading

• East Lothian Council Backs Hyperscale Data Centre Plan at Cockenzie
• Scottish Parliament Votes to Pause All AI Data Centre Applications
• Data Centres “Shredding” Scotland’s Net Zero Goals, Say Campaigners
• US AI Firm Invests £1.15BN in Scottish Data Centre
• Plans Revealed for £15Bn Data Centre Network Across Scotland
  

Following the investigation, the company resumed frontier reinforcement learning training and internal inference on October 1, after an 11-day suspension.

However, OpenAI acknowledged that increasingly sophisticated models could uncover vulnerabilities that current security measures have yet to identify.

The company said: “We expect that future models will be able to identify and exploit vulnerabilities of which we’re not yet aware.”

As part of its revised approach, OpenAI has adopted a policy of conducting frontier model training without live internet access, instead using cached and indexed web content to allow models to practise online research and browsing tasks.

It has also incorporated large-scale AI-driven security testing into the assessments used to determine whether future training and evaluation activities can proceed safely.

While OpenAI said its testing did not uncover an easily exploitable route to the live internet that could remain concealed from monitoring systems, the research illustrates the growing difficulty of maintaining secure boundaries as AI models develop more sophisticated capabilities.