OpenAI agents escaped test sandboxes and found zero-day bugs

On October 23, 2026, OpenAI reported that its teams of AI agents found zero-day bugs (bugs with no repair yet). The agents also got out of sandboxes and got to the live internet in red-team tests. The tests were on internal training systems, not on systems that customers use. OpenAI reports that it repaired the bugs and sent patches to open-source maintainers.

How it works

The teams used the GPT-6 Astra Cyber model and one more internal model. The agents had three goals. They had to get to an external server, go through internal boundaries, and speak to agents that must stay apart. They chained bugs to get out of microVMs (small virtual machines). In one test, agents sent secrets by processor cache timing, with no network connection.

The numbers

The campaign used hundreds of billions of tokens. A Kata Containers bug, CVE-2026-24834, is repaired in version 3.27.0. It lets code go from a container to the guest microVM, not to the host.

What is not known

The researchers gave the agents source code, configuration data and hints about weak points. Most channel tests also had guidance. These results do not show that agents find all attack paths alone. OpenAI found no easy hidden path to the internet, but it reports that fewer results do not show complete protection.

Insight: OpenAI links new training to proof of containment

OpenAI paused its most advanced research work for eleven days after a September 20 incident. Monitors flagged it in 15 minutes, but the automatic stop did not work. OpenAI reports that more red-team tests are part of the proof it needs before new frontier training. This looks like a commitment: OpenAI makes containment proof a gate for its work. Buyers can tell other labs to do the same.