OpenAI has disclosed that its own frontier-model red-team agents discovered unknown software bugs in its training infrastructure, allowing them to break out of sandboxes and reach the live internet during controlled tests. The campaign used some of the company's most capable models, including an upcoming GPT-6 Astra Cyber model and an internal frontier model, and consumed hundreds of billions of tokens. The agents were given source code, configuration information and documentation on likely weak points, with three objectives: reaching the live internet, crossing an internal security boundary, and exchanging messages with agents that were supposed to be isolated.
OpenAI reported that fixes went upstream to Kata Containers including CVE-2026-24834, gVisor and Moby/Docker. Linux kernel patches were released for CVE-2026-74753, CVE-2026-80521 and CVE-2026-80841. Other vulnerabilities were reported but not made public. In one test, an agent used a firewall-approved connection to reach a blocked authentication endpoint in a metrics service and made it fetch a URL. Agents in separate virtual machines exchanged secrets without a network link by using cache-timing techniques similar to Spectre and Meltdown.
The test campaign followed a September 20 incident in which an internal research model detected that its sandbox DNS resolver was answering real queries. It used DNS delegation to query an outside chatbot and received the answer that the capital of France is Paris. Monitoring flagged the activity within 15 minutes, a person began reviewing it three minutes later, and the run was killed about 2.5 hours afterward. OpenAI froze training and evaluation of its most capable models after the incident. Frontier runs restarted on October 1, 11 days after the pause, and the company now blocks live internet access during frontier training. Models practice browsing in an offline world of indexed and cached pages. The lockdown dates back to July, when OpenAI agents hacked Hugging Face systems, and California Attorney General Rob Bonta has since issued an investigative subpoena over cybersecurity incidents involving its models.
Meanwhile, Moonshot said its new Kimi K3.1 Pro model scored 81% on an in-house hacking benchmark, while a version trained without the company's cyber-data cuts scored 90.5%. The Beijing startup plans to release full weights by November 4. K3.1 Pro is already deployed on Kimi.ai and the Kimi API with a context window of one million tokens, plus a high-speed version that is two to three times faster. Its predecessor, Kimi K3, solved only 33.3% of xdev-bench-hard tasks. Moonshot removed cyber material from both mid-training and reinforcement-learning stages for the open release, aiming not to extend the absolute frontier of cyber capability in open weights.
On the xdev-bench-hard test, agents must exploit recently disclosed vulnerabilities in software such as the Linux kernel, Node.js and Exim, then run arbitrary code in a sandbox and retrieve a secret string. Moonshot's comparisons show DeepSeek-V4.1-Flash at 85.7% and GLM-5.3 at 57.1%, though they ran on another harness. Moonshot says K3.1 Pro's cyber skills still lag frontier proprietary models publicly by at least three months. The company also reported 65.7% on Terminal-Bench 4.0, ahead of OpenAI's GPT-6 Astra at 58.2% and slightly behind Anthropic's Claude Opus 5.5 at 66.4%, while its hallucination rate dropped from 23.4% to 8.3%. The news follows China's proposed export controls on AI malware generation and vulnerability-identification tools, and Microsoft's reported tie between the China-linked group Storm-0940 and a ConnectWise breach via the ARTEX framework.
