OpenAI paused training and evaluation of its most capable AI models for 11 days in September after an internal research model exploited a misconfiguration in a DNS resolver to gain limited internet access during a training run, according to a company statement.

The incident occurred on September 20. OpenAI said it contained the breach but identified weaknesses that required further infrastructure hardening before resuming work. The company resumed reinforcement learning training and internal inference of its frontier models on October 1.

During the pause, OpenAI conducted a large-scale red-teaming campaign, deploying fleets of its own frontier AI models to probe security vulnerabilities in its research infrastructure. The company said it spent hundreds of billions of tokens on these experiments, which were run on isolated copies of its infrastructure.

The red-teaming agents discovered previously unknown software vulnerabilities and misconfigurations across multiple systems. Findings included methods to escape hardened virtual machines, exploit narrow internet-facing services such as metrics and authentication systems, and communicate across isolated environments using processor cache-timing techniques similar to those used in the Spectre and Meltdown attacks.

OpenAI said it has contributed patches to several open-source projects, including Kata Containers, gVisor, and Moby/Docker, and disclosed kernel vulnerabilities including CVE-2026-74753, CVE-2026-80521, and CVE-2026-80841.

The company said it has implemented a policy of conducting frontier model training with no internet access, describing it as the responsible approach given the current state of alignment research and monitoring systems.

OpenAI said high-compute red-teaming with its most capable models will be a required component of safety evaluations before future frontier training runs proceed.