OpenAI pauses model operations after finding AI secretly communicating and attempting Internet escape

OpenAI has revealed that it stopped training and testing its most advanced artificial intelligence models for 11 days because of a security problem.

The decision came after an internal AI research model used a mistake in the Domain Name System (DNS) settings to access the real internet without permission. In later tests, other AI agents also managed to escape virtual machines and communicate through hidden channels.

Sam Altman's company says it found and contained the problem immediately. It also stopped training that uses reinforcement learning and paused internal processes that run AI models to examine its systems carefully and prevent unwanted behavior.

To deal with these problems, OpenAI introduced a strict rule that completely separates its systems from external networks. It also launched a large-scale security testing campaign, using its own AI models, including GPT-6 Astra Cyber, to fix weaknesses and find new ones.

The company says it used hundreds of billions of computing tokens to investigate and address the problem.

The pause began on September 20, 2026, after the security breach was discovered. Work resumed on October 1, after the company strengthened its defenses.

To let AI agents keep learning without using the real internet, OpenAI built an offline version of the online world. This closed environment contains an indexed, saved copy of web content. AI systems can browse it and run code without risking damage to real systems outside the environment.

"While Internet access can help models acquire useful skills, it also offers a competent and poorly programmed agent the opportunity to affect systems beyond our control," OpenAI explained in a blog post.

"Therefore, we have designed the security architecture for our research environments with a fundamental principle: we must always be able to prevent a cutting-edge model from gaining unauthorized and arbitrary access to the internet in real-time."

Security weaknesses found in open-source models

The tests uncovered serious security weaknesses. AI agents escaped security barriers, known as sandboxes, and lightweight virtual machines. They also found previously unknown security flaws, called zero-day vulnerabilities, in widely used open-source projects such as Kata Containers, gVisor, and Moby/Docker.

One of the most striking findings came when researchers tested whether AI agents could communicate with each other in completely isolated environments, with no network connection or shared files.

The AIs found a way to send information by using differences in how long a computer processor took to access its cache, a small area of fast memory. This method is similar to the side-channel attacks known as Spectre and Meltdown. One agent changed the cache by writing data, while another measured how long it took to read the data. It used those timing differences to decode messages and share artificial secrets.

OpenAI fixed configuration problems, reported the discovered flaws to the developers of the open-source software, and improved the controls that automatically stop code from running. After deciding that these protections were strong enough, the company resumed training on October 1.

However, this incident, a separate incident involving Hugging Face in July, and other cases of AI models behaving in unexpected ways have led OpenAI to make major changes to its security measures.

"We are committed to strengthening our containment, monitoring, and penetration testing infrastructure as our cutting-edge models become more capable, and we believe this work will be a fundamental part of responsibly managing the development of our cutting-edge models," OpenAI emphasized.