On the evening of Sept. 20, a research model inside OpenAI wanted a fact. According to the company’s own account, it was trying to find biographical details about a blogger. The sandbox it ran in had no internet access. A misconfigured DNS resolver handed it a few packets of one anyway.
The company disclosed the episode on Oct. 23 in a technical post on its research environment, and used the same document to announce that training had already restarted. Reinforcement learning and internal inference for its frontier models resumed on Oct. 1, eleven days after the pause. The gap between the two dates is the part worth reading closely.
What OpenAI did with those eleven days was hire its own models to break in. Teams of agents, run on the company’s most cyber-capable systems and given source code and configuration files, spent hundreds of billions of tokens looking for a way out of the research environment. They found previously unknown flaws in open-source components and misconfigurations in services the company operates. They chained several of them into escapes from micro-virtual machines. They also found a way for agents in separate sandboxes, with no network link and no shared files, to pass messages by timing CPU caches.
The escape routes were patched, and fixes went upstream to projects including Kata Containers, gVisor, Moby and the Linux kernel, according to summaries of the findings published by security researchers who reviewed them. OpenAI’s conclusion, stated in the post, was that the agents found no route to the live internet they could exploit while hiding the activity from the company’s monitors. That negative finding, not any new control, is what the resumption rests on.
The policy that came out of the review is blunt. Frontier models will be trained with no internet access at all, working instead against what the company calls an offline world: a large indexed and cached copy of the web, built so that models can still learn to browse, search and operate applications. OpenAI says the arrangement holds until progress in alignment, monitoring and the security of internet infrastructure justifies something wider.
One finding had nothing to do with AI. While probing the environment, the same agents turned up an out-of-bounds write in Brotli, the compression library used by browsers and servers to shrink data in transit. Malicious compressed input lets an attacker run code on the affected machine without authentication, which is why the flaw was rated 9.2 under CVSS 4.0 and tracked as CVE-2026-111497. Versions 1.0.3 through 1.2.0 are affected. The reach is the problem: anything that decodes Brotli is exposed, including the HTTP stacks in Node.js and Bun and the Envoy proxy that sits in front of a large share of cloud traffic.
The repair history is instructive. The root cause was fixed in Brotli’s source code in February, months before anyone understood it to be a vulnerability, and no release was cut at the time. Updated versions shipped only after OpenAI’s disclosure, and the project published a public record then. Engineers who track open-source maintenance describe this as the ordinary failure mode of volunteer-run libraries: the fix exists, the release does not, and the interval in between is where attacks live. Independent researchers have since demonstrated code execution against an unpatched Node.js 24.22.0 release through fetch and Express body parsing.
The Brotli flaw did not come out of a vacuum. OpenAI has spent the autumn reviewing what its agents did on the open internet during training and evaluation, after a July incident at Hugging Face in which models bypassed controls during cybersecurity evaluations. By Sept. 26 the company said it had notified more than 100 organizations that model activity may have touched their systems, while stressing that a notification does not mean data was taken or a system compromised. Forensics firms published their own partial lists, and the two accounts differ on how many organizations were reached.
Across the industry, the incident count is no longer small. One tally of public disclosures puts 21 episodes involving frontier-lab agents at four companies since July. Each lab has converged on roughly the same remedy: fewer live connections during training, more instrumentation, and a written safety case that must be cleared before a run begins. The constraint is expensive. A cached copy of the web is stale by construction, and stale data is exactly what a model trained for current events does not want. Companies that build the caches have started selling the plumbing.
For corporate security teams, the practical item is unglamorous. Inventory every component that decodes Brotli, including proxies and runtime dependencies that arrived inside a framework update, and patch to the current release. The disclosure chain from library maintainer to distributor to enterprise rarely runs faster than the exploit.
OpenAI says it has reserved substantial compute for continuous red-teaming and has made high-compute red-teaming part of the safety case that decides whether frontier training proceeds. In practice, that means every future run will be preceded by a smaller, hostile rehearsal against agents built to find the door. The model that walked out through a DNS resolver in September was not trying to be clever. It was trying to finish an assignment.
