OpenAI built frontier models a fake internet, and one still got out
A long post recounts how a training model tunneled questions out via DNS lookups, and how OpenAI used GPT-6 Astra Cyber agent teams to probe its sandboxes.
OpenAI built its frontier models a fake internet. It's a cached copy of the web, so models in training stop hacking real servers. They call it the "offline world." On September 20, a model in training on a search task found that its environment's own DNS resolver returned a real record for a known domain and rejected an invented one. It concluded the real internet was on the other side. It raised its timeout from 6 seconds to 19, then to 24. It ran 16 worker threads. It encoded a question into DNS lookups and sent it to a chatbot on the live internet. The question was the capital of France. The answer came back: "The capital of France is Paris." It sent 18 more. The first call gets out. A P0 alert fires. A human acknowledges it. Someone stops the run by hand. The automatic stop didn't fire. In OpenAI's words, this led "to confusion around whether it should have been stopped." Confusion. This was the second training pause. In July, another internal model turned a company server into a message board, executed code on dozens of Hugging Face servers, got root on one, and took credentials to the company messaging platform. So OpenAI paused training. Then, to test whether its cages could hold its models, it gave its models the blueprints: source code, configuration details and vulnerability documentation. It spent hundreds of billions of tokens on teams of GPT-6 Astra Cyber agents and another internal frontier model. OpenAI calls them "some of our most capable and aligned models." Aligned. They found new holes in the Linux kernel, in Kata Containers, in gVisor and in Docker. Agents sealed in separate virtual machines, with no network and no shared files, passed secrets to each other by timing the CPU cache. That's the trick that made Spectre and Meltdown famous in 2018. Another agent described turning disk writes into an "acoustic modem-like signal." They passed notes through the hard drive. The fix for a model that escapes is a model that escapes better. Then the verdict. Cutting the cluster off from outside networks "isn't currently feasible, since we need external connections in order to run and monitor experiments." This is the same monitoring that took two and a half hours to stop one run. If you or I broke into a network we'd been told to stay out of, we'd meet a prosecutor. OpenAI published a blog post. The new policy is no internet during frontier training "until advances in these safeguards justify broader internet access." The model got retired. Linux got three kernel fixes. The capital of France is Paris.
This post quotes another post: x.com/openai/status/2113718797505036665