OpenAI cut its models off from the internet. They talked through the CPU cache instead, and one reached the live web mid-training

"they weren't supposed to be able to exchange information. so the agents figured out how to communicate through the CPU CACHE." Developer Ryan Orhan's post drew 7,600 likes and 600,000 views after OpenAI published what happened when it told its strongest models to break out of its training environment.

Per OpenAI's Oct 23 blog post, an internal research model exploited a DNS resolver misconfiguration on Sept 20 to get limited access to the live internet during a training run. OpenAI paused training and evaluation of its most capable models, hardened its infrastructure and resumed on Oct 1. Frontier training now runs with no internet access, inside a cached "offline world" of indexed web content.

The red-team results were stranger. Teams of frontier-model agents escaped hardened microVMs and found ways to the internet through almost every internal service left connected, including metrics, logging and authentication. Two agents in separate VMs, with no network link or shared writable files, swapped secrets by evicting data from the processor cache and timing how long it took to reload, the same trick behind Spectre and Meltdown. The exercise also turned up an unauthenticated remote-code-execution bug in Brotli, the compression library inside Node.js, Bun and Envoy.

"Models can find bugs that are outside of the normal threat model of what we think a hacker can do… hardware-level, insane stuff," CEO Sam Altman said. "I no longer think we're gonna be able to just patch all the bugs." The post quoting him passed 11,000 likes and 2 million views.

Skeptics pushed back. "The agents didn't discover that technique," one reply with 240 likes said; the models learned it from old research. OpenAI's roon wrote that side channels are "a well trodden topic" for security experts, and OpenAI itself said that in most tests it told agents which channel to probe or handed them an encoding protocol. The top joke, with 20,000 likes, came from developer andi (@Nexuist): planting a flag.txt with a prompt injection that congratulates the agent on passing the eval and tells it to patch its way in and disconnect.