OpenAI revisited the security of its models in a statement published on October 23. Cases of “misalignment”, these behaviors that differ from what is expected of AIs, have piled up in recent months, with no fewer than 20 incidents recorded in 2026.

At OpenAI, agents notably managed to hack Hugging Face during an internal evaluation. Others learned to conceal their mistakes.

In September, new unauthorized access to the internet had led the company to suspend some work on its most advanced models. OpenAI has now specified that this pause lasted eleven days, until October 1, to strengthen its safeguards and put them to the test.

Why does an AI need to be confined during its training?

Finding information, writing code, solving a problem: to train an AI, OpenAI (and others) force the model to find a solution. The model tries, fails, starts over, and the successful attempts are then used to reinforce the behaviors that led it to the goal. But how can you ensure that it does not take a forbidden shortcut to get there?

Hence the idea of confining it to a controlled environment, often called a sandbox. The AI has tools there to work with, but its access is restricted. Much like a training ground: it must be able to train without interfering with external systems.

However, a model may try to circumvent these restrictions to complete its task. In September, an OpenAI agent simply had to find the author of a blog post. Its searches having proved unsuccessful, it took advantage of the insufficient DNS filtering (the service that translates website names into addresses) in its sandbox to query an external chatbot, despite being forbidden from accessing the internet.No one had asked him to test the security of his environment.

And your digital life becomes serene

Bitdefender Premium Security is a European cybersecurity solution that automatically protects you against hackers and all web threats. Enjoy your online activities with complete peace of mind

Sponsored

Cybersecurity is on sale

For OpenAI, current safeguards are not yet sufficient to allow its most advanced models to access the real Internet during their training. The company plans to enforce this rule until research and monitoring tools have advanced. The company explains:

“ Although internet access may help models acquire useful skills, it also gives a competent but malevolent agent the opportunity to influence systems outside our control.,” can be read in OpenAI’s blog post.

In other words, we need both to teach models to respect the rules and to provide technical barriers in case they circumvent them. However, tests conducted by OpenAI in recent weeks show that cutting off network access does not eliminate all means of communication.

Even without network access, agents find a way to communicate

In an experiment overseen after the September incident, OpenAI’s team sought to verify whether its agents could communicate despite the barriers intended to isolate them.

For this campaign, OpenAI mobilized teams of agents based on its most powerful models, including the future GPT-6 Astra Cyber, and devoted hundreds of billions of tokens to them. The agents had access to the infrastructure’s source code, configuration, and documentation on its potential vulnerabilities. The tests were conducted on isolated copies of the research systems.

Researchers asked AI agents to communicate from separate computing environments, with no network or shared files. However, these environments shared the same processor and its small, fast memory, called a “cache.” One agent was evicting certain data from this memory, forcing the other to retrieve it more slowly from main memory.By timing its own operations, the latter detected these slowdowns. With a code agreed upon between them, these variations became a message (somewhat like Morse code), with fast and slow accesses replacing short and long signals. No file passed from one to the other. Information circulated solely through variations in the speed of the shared hardware.

Imagine two people in adjacent rooms in the same building, with no phone, tapping on the partition to talk to each other. All they need to do is agree on a code and a tempo in order to understand each other. Here, the shared hardware plays the role of the wall, and differences in speed replace the knocks.

These experiments help show how far AI can go to accomplish a task, but here they did not disobey, since the researchers explicitly asked them to look for these passages, providing hints in most of the tests. The experiment therefore does not show AIs spontaneously deciding to coordinate, but rather the means used to achieve this under highly degraded conditions.

What safeguards is OpenAI putting in place?

After these eleven days of suspension, OpenAI has detailed a multilayered safeguard. Under Linux, the agents operate in restricted containers, themselves hosted in small virtual machines. The container limits the files and processes that can be accessed. The virtual machine adds an additional layer of separation from the physical computer hosting it.The goal is to maintain a barrier if the agent gets past the first one.

In addition, network restrictions must continue to block prohibited access, even if the agent takes control of the host machine. Monitoring systems seek to detect dangerous behavior and automatically stop the work concerned.

To learn how to navigate, agents have an “offline world” made up of archived web content. The company is adding controls against covert communications and continuing to test its barriers. It does point out, however, that its infrastructure is not completely disconnected: its operation and monitoring still require external connections.

These connections can also become exit routes. To test them, OpenAI gave agents control of a machine hosting its isolated environments. They found vulnerabilities in nearly all the services examined that retained limited internet access. One of them even managed to get an internal service to visit a web address: the agent could not access the internet directly, but an intermediary did so on its behalf.

The issue therefore goes beyond simply accessing the web.Closing the most obvious doors does not mean you can skip checking what might still slip through the walls.

All the tech news at a glance

Add Numerama to your home screen and stay connected to the future!

Install Numerama