What AI can now do·Oct 23, 2026·Cyber

AI agents chain flaws into virtual-machine escapes and talk across isolation through the CPU cache

OpenAI (internal red team)

hundreds of billionsof tokens spent on the red-team campaign

Given source code and vulnerability documentation, fleets of OpenAI agents broke out of hardened microVMs onto host machines and exchanged a secret between isolated VMs by timing processor-cache reloads, the Spectre-and-Meltdown mechanism.

How far it has travelled

From a demonstration to real life, in five steps. Empty steps are the point: a demonstration is not a deployment.

Demonstratedshown once, by its developer or a researcher
yes · Oct 23, 2026 · OpenAI's Oct 23 post, per Reuters and GBHackers: VM escapes through Kata Containers (CVE-2026-24834), gVisor and Moby/Docker issues; a cache-timing covert channel between microVMs; a firewall-approved connection reused to reach a blocked endpoint. OpenAI calls it an attacker-favorable test, not unaided discovery. source
Reproducedshown again by someone else
unknown · No outside party has reproduced the escapes or the covert channel; OpenAI says researchers guided most covert-channel tests toward particular channels or supplied the encoding. source
Accessibleavailable to the public or to customers
no · Oct 23, 2026 · The agents included an unreleased 'GPT-6 Astra Cyber' model on isolated copies of OpenAI's own infrastructure; nothing is public. source
Reliableworks most of the time on a defined task
unknown · No success rates published.
Real consequenceshas changed something in the world, for good or ill
partial · Oct 23, 2026 · OpenAI says the sandbox flaws it found are fixed; it now trains its most capable models with no live internet access, against a cached offline copy of the web. No harm outside the test environment is claimed. source

What this could change for you

The sandboxes that are supposed to keep AI agents contained can be climbed out of by the agents themselves once they are good enough; the lab's answer was to cut its training runs off from the internet entirely.

Incidents it made possible

Sources

primary source, second source. Evidence confidence: medium.

A milestone is a dated, sourced result that moved what AI can do; a stage is upgraded only when a source shows it (a reproduction, a public release, production evidence, a documented consequence). “Unknown” is the honest default.