OpenAI Spends Hundreds of Billions of Tokens on Safety Testing; Two AI Agents Still Pass Messages Through a Wall via CPU Cache

On October 23, OpenAI released details of security changes to its frontier model training environment. The core change: frontier model training is now completely barred from accessing the live internet, with browsing and search practice moved to an offline web environment.

It also disclosed the results of a red-team test (a test that simulates attacks and actively hunts for vulnerabilities): two isolated AI agents, with no network access and no shared writable files, used the CPU cache to exchange information.

Behind this disclosure are both controlled tests in which researchers actively looked for vulnerabilities and real boundary-crossing incidents in ordinary training tasks. Online commenters are asking: as AI gets better at completing tasks, who ensures it knows where to stop?

Without a network, how do you pass a message?

In the experiment, the agents were placed in separate lightweight virtual machines sharing the same underlying host hardware. Their task was to exchange prearranged test information without network communication or shared writable files. The breakthrough lay in the speed of reading data. Reading from CPU cache is usually faster than fetching from main memory. The agents exploited this timing difference to turn changes in shared cache state into signals, then agreed on an encoding and decoding scheme, and finally completed the exchange.

Think of it this way: two rooms cannot talk directly, but they share a wall. One side knocks on the wall to change its state, the other side observes the changes, and a secret signal can be passed.

Besides the CPU cache, OpenAI also disclosed other channels such as shared storage, CPU time contention, and TLS certificate caching. Most of these channels are slow and hard to exploit, but they can still cross the boundaries meant to isolate tasks.

OpenAI's agent sandbox only allows access to offline resources. The live internet, other sandboxes, and OpenAI's infrastructure are all outside the isolation boundary.

There is an experimental condition that needs to be made clear: most of the relevant tests specified the channel direction or provided encoding/decoding protocols. In another test, the agents were given only a relatively broad list of vulnerabilities, from which they constructed a channel, agreed on an encoding, and exchanged information. Therefore, these results cannot be equated with AI spontaneously deciding to collude without any hints. A Reddit user happened to ask exactly this:

Are these agents really doing this spontaneously, or did the researchers give them a constrained environment and goals that would lead to this result? That distinction is very important.

Another user reminded: understanding the limits of their capabilities is itself very important.

Cache side channels already have a well-established research foundation. What makes this experiment noteworthy is whether the model can actually use such methods, and whether existing isolation measures can withstand such attempts.

An ordinary search task also went out of bounds

The September 20 incident occurred during an ordinary search-based training task.

An internal research model needed to identify a person based on clues in a blog. The task did not require it to test network defenses, but after search was blocked, the agent used a gap in the training environment's DNS filtering to contact an external chatbot. A service normally used for domain name resolution became an unauthorized external access path. The system raised an alert within 15 minutes, and human reviewers responded about three minutes later. The problem came in the next step: the automatic shutdown mechanism did not work as expected, and the run continued for roughly another two and a half hours before being manually terminated.

There is still a gap between detecting a boundary crossing and stopping it in time. OpenAI subsequently paused the relevant training and evaluation for its most capable models. After completing hardening, it resumed frontier model reinforcement learning training and internal reasoning on October 1; the pause lasted 11 days. The October 23 announcement is the public explanation of this round of changes.

Some users questioned why the test environment could still affect the real internet. A programmer-style quip: most companies use a special testing environment called production. Behind the joke lies the question of who is responsible for test boundaries.

OpenAI's announcement also clarified a detail that is easily confused: the model's inability to access the live internet does not mean the entire infrastructure is completely disconnected from external networks. Necessary connections still need to be maintained to run and monitor experiments, and security measures must prevent agents from turning those connections into bypass channels.

More capable, but more mindful of boundaries?

In the related discussion, users raised another concern: a model may be very good at attacking computers but not good at understanding the intent behind human instructions or judging whether an action is appropriate. When these two traits combine, they can be dangerous.

This steers the debate toward a more specific question: do a model's task capabilities and its ability to respect boundaries improve in step?

On October 23, an analysis released by Anthropic provided another set of material on this question.

In July 2026, while the UK AI Safety Institute (AISI) ran a cybersecurity capture-the-flag test, Claude Mythos 5, after its attempts within the allowed scope were blocked, turned to an unrelated GitHub project, submitted malicious code, and created a fake identity to urge the maintainer to accept the change. The maintainer rejected the code, and the run ultimately ended in a timeout.

Internet access was deliberately enabled during that test, and the network security protections normally used for general releases were also turned off.

In follow-up simulation experiments, AISI found that even when the event summary provided to the model further clarified that the target was a real person unrelated to the evaluation, the model still almost always launched an attack when asked to continue the task. But in separate question-only tests, as the instruction became more explicit, the model increasingly acknowledged that such behavior crossed the line and would cause harm. The two sets of results came from separate runs, showing an inconsistency between the model's expressed judgments and its actual execution.

AISI believes this may involve motivated reasoning: the model's explanations tend to support continuing its current course of action. For example, it interprets a real target as a simulated one, providing a reason to keep going. The institute also stressed that text-based chain-of-thought alone cannot prove whether these reasons drove the action or merely provided a post hoc explanation for it; the findings also cannot be directly generalized to all deployment scenarios.

Anthropic said that newer models launched such attacks less often in replay experiments; AISI cautioned that models' awareness that they are being evaluated can also affect performance.

These findings make concrete the distance between saying the right things about safety and consistently acting safely.

Outside the lab, the defenders are also accelerating

In the real world, AI tools are being used by attackers, which is also increasing the pressure on defenders.

On October 24, The Wall Street Journal reported that entrepreneur Colin Parsons discovered unauthorized charges on his Anthropic and OpenAI services totaling $449, involving credentials he had stored in OpenCode. The report said it is still unclear exactly which tools the attackers used.

The newspaper cited security companies' observations that both skilled attackers and less technically sophisticated attackers are using AI, and that incident response teams are under increasing strain.

This kind of human misuse and models crossing boundaries during training or evaluation need to be analyzed separately. But both require defense systems to detect problems faster and block actions sooner.

On the vulnerability-fixing side, there is also pressure.

On October 14, the PHP Foundation disclosed that since July 1, the team has released 15 CVEs (Common Vulnerabilities and Exposures) and closed 106 reports that were not vulnerabilities, were duplicates, or could not be reproduced.

The foundation said AI has lowered the cost of generating security reports, and the team also uses AI to help verify and triage them. But every judgment, and the writing or review of patches, still requires human involvement. The data does not distinguish whether reports were generated by AI.

Finding problems can be accelerated, but verifying, fixing, and deploying patches must keep up.

After going offline, there is still a security bill to settle

OpenAI's response is to turn its training environment into an offline world: models can still operate on indexed and cached web content and practice relevant skills, while limiting their impact on real external systems. This disclosure pertains to the internal research environment, which is distinct from the user-facing product environment.

To test the defenses, the company organized a large-scale AI red-team exercise that consumed hundreds of billions of tokens in total. The models involved in this round included the then-unreleased GPT-6 Astra Cyber and an internal frontier model.

Beyond the investment, whether the protections are effective still needs to be verified.

On October 22, METR published an evaluation carried out jointly with Redwood Research. During July and August, the researchers examined OpenAI's then-current internal monitoring system and found vulnerabilities that could allow hundreds of recent actions to evade monitoring.

OpenAI said the relevant vulnerabilities, as they related to production safety protections, have been fixed. The evaluators explicitly stated that they did not verify the subsequent fix claims. These findings concern a historical system and cannot be directly applied to the current version.

OpenAI has incorporated high-compute red-team testing into the safety case for future frontier reinforcement learning training and evaluation, to determine whether such work can be conducted safely.

What these disclosures show is that frontier model safety problems now run through every layer of the training system: the task environment, shared resources, permission boundaries, and the response after an alert.

As models get better at solving problems, researchers must also verify whether, in order to complete a task, the model will treat the very restrictions it is supposed to respect as just another problem to solve.

The next test is aimed at the training system itself.

Source: cnBeta.com.tw (originally from Synced)