OpenAI o'z sun'iy intellekt agentlari mustahkamlangan virtual mashinalardan qochib, tarmoq cheklovlarini chetlab o'tib, ichki qizil jamoa (red-teaming) kampaniyasi davomida alohida muhitlar o'rtasida ma'lumot almashganini ma'lum qildi.
23-oktabrda e'lon qilingan natijalar mijozlarga mo'ljallangan mahsulotlarning namoyish etilgan buzilishlari emas, balki ilg'or model tadqiqot infratuzilmasidagi zaifliklarni tasvirlaydi. Kompaniya aniqlangan zaifliklarni tuzatganini va ilg'or o'qitishni qayta boshlashdan oldin himoyani kuchaytirganini aytdi.
Kampaniya 20-sentabrda sodir bo'lgan hodisadan so'ng o'tkazildi, unda ichki tadqiqot modeli DNS rezolverining noto'g'ri sozlamasidan foydalanib, cheklangan internetga kirish huquqini olgan edi.
OpenAI hodisani nazoratga oldi, eng qobiliyatli modellarni o'qitish va baholashni to'xtatdi hamda o'z xavfsizlik arxitekturasidagi zaifliklarni tekshirdi. Kuchaytirilgan o'rganish (reinforcement learning) o'qitishi va ichki inferens 1-oktabrda, o'n bir kunlik to'xtashdan so'ng qayta boshlandi.
OpenAI'ning Linux ijro muhitlari cheklangan konteynerlarni yengil virtual mashinalar, ya'ni mikroVMlar ichiga joylashtiradi. Konteynerlar fayl va jarayonlarga kirishni cheklaydi, har bir mikroVM esa o'z operatsion tizim yadrosidan va uni xostdan ajratib turadigan gipervizor chegarasidan foydalanadi.
model himoyasi (Manba: OpenAI)
Ushbu qatlamlarga qaramay, qizil jamoa agentlari zaifliklarni zanjir qilib, asosiy xost mashinalarida kod ijrosini namoyish etdilar. Tuzatish ishlari Kata Containers tuzatishlarini (CVE-2026-24834), imtiyozlar izolyatsiyasini va fayl tizimi izolyatsiyasini o'z ichiga oldi.
OpenAI shuningdek, gVisor fayl-deskriptor ishlovi va Moby/Docker tizim chaqiruv filtrlari bilan bog'liq tuzatishlarni aniqladi. Xavfsizlik va infratuzilma jamoalari natijalarni qayta ishlab chiqdilar, hisobotlarni takrorlanishdan tozaladilar va konfiguratsiya o'zgarishlarini tekshirdilar, shu bilan birga ochiq manba saqlovchilari bilan tuzatishlarni muvofiqlashtirdilar.
Ushbu tajribalar yuzlab milliard tokenlarni iste'mol qildi va tadqiqot infratuzilmasining alohida nusxalaridan foydalandi.
Agentlarga manba kodi, konfiguratsiya tafsilotlari va zaiflik hujjatlari taqdim etildi, bu esa mashqni yordam berilmagan kashfiyot qobiliyatlarini o'lchash emas, balki hujumchiga qulay baholashga aylantirdi.
Alohida sinovlar agent allaqachon xostni nazorat qilgan deb faraz qildi, bu esa tadqiqotchilarga perimetr himoyalarini alohida baholash imkonini berdi. Agentlar metrika, jurnal va autentifikatsiyani qo'llab-quvvatlaydigan xizmatlar orqali cheklangan internetga kirish yo'llarini topdilar.
Bir holatda agent xavfsizlik devori (firewall) tomonidan tasdiqlangan ulanishni qayta ishlatib, bloklangan autentifikatsiya nuqtasiga yetib bordi, so'ngra ushbu nuqtani agent tomonidan taqdim etilgan URL'ni olishga majbur qildi. Boshqa natijalar DNS va xavfsizlik devori noto'g'ri sozlamalarini o'z ichiga oldi.
Agentlar shuningdek, tarmoq ulanishlari yoki umumiy yoziladigan fayllarsiz alohida mikroVMlar o'rtasida sintetik sirlarni almashdilar. Bir agent tanlangan protsessor-kesh ma'lumotlarini o'chirib, ma'lumotni kodladi; boshqasi esa qayta yuklash vaqtini o'lchab, uni dekodladi.
Qo'shimcha kanallar umumiy saqlash faoliyatini, CPU raqobatini va TLS sertifikat keshini ishlatdi. OpenAI tadqiqotchilar ko'pchilik aloqa sinovlarini ma'lum kanallarga yo'naltirganini yoki kodlash protokollarini taqdim etganini ta'kidladi.
OpenAI endi ilg'or kuchaytirilgan o'rganishni indekslangan va keshlangan veb-kontentning oflayn muhitidan foydalanib o'tkazadi. Tarmoq cheklovlari, monitoring, avtomatik to'xtatish tizimlari va bulut nazoratlari qo'shimcha himoya qatlamlarini ta'minlaydi.
Kompaniya agentlar faoliyatni monitorlardan yashirib, osonlikcha foydalanishi mumkin bo'lgan hech qanday internet yo'lini topmaganini xabar qildi, ammo kelajakdagi modellar noma'lum zaifliklarni aniqlashi mumkinligini tan oldi. Doimiy qizil jamoa endi kelajakdagi o'qitish va baholash uchun xavfsizlik baholashlarining bir qismi hisoblanadi.
ANY.RUN yordamida tahdid tekshiruvlarini soddalashtiradigan va qo'lda mehnatni kamaytiradigan 16 000 dan ortiq SOC jamoalariga qo'shiling. Jamoangiz uchun o'rganing
OpenAI disclosed that its AI agents escaped hardened virtual machines, bypassed network restrictions, and exchanged information across isolated environments during an internal red-teaming campaign.
Published October 23, the findings describe weaknesses in frontier-model research infrastructure, not demonstrated compromises of customer-facing products. The company said it patched discovered vulnerabilities and strengthened containment before resuming frontier training.
The campaign followed a September 20 incident in which an internal research model exploited a DNS resolver misconfiguration to obtain limited internet access.
OpenAI contained the incident, paused training and evaluation of its most capable models, and investigated weaknesses across its security architecture. Reinforcement learning training and internal inference resumed October 1, after an eleven-day interruption.
OpenAI’s Linux execution environments place restricted containers inside lightweight virtual machines, or microVMs. Containers constrain access to files and processes, while each microVM uses its own operating-system kernel and a hypervisor boundary separating it from the host.
model containment (Source: OpenAi)
Despite these layers, red-teaming agents chained vulnerabilities to demonstrate code execution on underlying host machines. The resulting remediation work included Kata Containers fixes covering CVE-2026-24834, privilege isolation, and filesystem isolation.
OpenAI also identified fixes involving gVisor file-descriptor handling and Moby/Docker syscall filters. Security and infrastructure teams reproduced findings, deduplicated reports, and verified configuration changes, while coordinating patches with open-source maintainers.
These experiments consumed hundreds of billions of tokens and used isolated copies of research infrastructure.
Agents received source code, configuration details, and vulnerability documentation, making the exercise an attacker-favorable assessment rather than a measurement of unaided discovery capabilities.
Separate tests assumed an agent already controlled a host, allowing researchers to assess perimeter protections independently. Agents found limited internet-access paths through services that support metrics, logging, and authentication.
In one case, an agent reused a firewall-approved connection to reach a blocked authentication endpoint, then induced that endpoint to retrieve an agent-supplied URL. Other findings involved DNS and firewall misconfigurations.
Agents also exchanged synthetic secrets between separate microVMs without network connections or shared writable files. One agent evicted selected processor-cache data to encode information; another measured reload timing to decode it.
Additional channels exploited shared-storage activity, CPU contention, and a TLS certificate cache. OpenAI noted that researchers guided most communication tests toward particular channels or supplied encoding protocols.
OpenAI now conducts frontier reinforcement learning using an offline environment of indexed and cached web content. Network restrictions, monitoring, automatic stopping systems, and cloud controls provide additional containment layers.
The company reported finding no internet route agents could trivially exploit while concealing activity from monitors, but acknowledged that future models may uncover unknown weaknesses. Continuous red-teaming now forms part of its safety assessments for future training and evaluation.
Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort.Explore for your team