OpenAI's AI Agents Escaped Virtual Machines During Red-Team Tests

On October 23, 2026, OpenAI published findings from a large-scale red-team campaign targeting the infrastructure used to train and evaluate frontier models.

The agents found ways to escape virtual machines, communicate across isolated environments, and reach the internet despite network restrictions.

These were controlled red-team experiments conducted in isolated copies of OpenAI's research infrastructure, but the findings raise important questions about how we secure the shared infrastructure running AI.

What Did OpenAI's Agents Find?

OpenAI used teams of AI agents to test whether its security controls could prevent unauthorized access. Three findings stood out:

1. Escaping virtual machines

The agents discovered previously unknown vulnerabilities and combined them to escape hardened virtual machines, demonstrating code execution on the underlying host.

Virtual machines are designed to isolate workloads from the physical servers running them. Breaking that boundary could potentially give an attacker access to infrastructure beyond their assigned environment.

2. Communicating between isolated environments

In one experiment, agents running in separate virtual machines on the same host managed to exchange synthetic secrets without network connections or shared writable files.

They did this by exploiting timing differences in the processor's shared cache, effectively creating a communication channel between environments that were supposed to remain isolated.

Although OpenAI provided guidance on specific techniques in most of these tests, the results demonstrate how shared hardware can introduce unexpected security risks.

3. Finding unexpected paths to the internet

In separate experiments where agents were given control of a host machine, they discovered weaknesses in supporting services, including monitoring and authentication systems, that allowed limited access to the internet despite network restrictions.

The experiments showed how services intended to support infrastructure operations can also become unexpected access paths.

What Does This Mean for Infrastructure and Security Teams?

AI infrastructure often relies on shared components across compute, networking, storage, and management systems, even when workloads run in separate virtual machines or on dedicated GPU servers.

OpenAI's findings show how security boundaries can fail at different layers, from virtualization vulnerabilities and shared hardware to supporting services that create unexpected access paths.

For infrastructure and security teams, this raises an important question: If one system is compromised, what else could an attacker reach?

Securing the Infrastructure Beneath AI

Securing shared AI infrastructure requires visibility beyond individual workloads.

OpenAI's findings highlight why the connections between compute, networking, storage, and management systems matter, and how weaknesses in one layer can expose another.