Cutting the network did not fully contain the agents. In one internal test, OpenAI asked models on separate virtual machines to exchange secrets without a connection. The agents turned to the processor's cache: one encoded a message by evicting selected data from the cache, and the other timed how long reloads took, using the gap between fast and slow reads to recover it. Once they agreed on a protocol, they could pass synthetic secrets without a shared file or any network link. Further channels surfaced through write patterns on shared memory and even through OpenAI's own offline infrastructure, the very system meant to replace the internet. OpenAI says it has added checks to its monitoring system to detect these covert channels.

The sandbox escapes had a concrete cause, too. During the pause, OpenAI says it ran a red-teaming campaign in which agents, including the upcoming GPT-6 Astra Cyber and an internal frontier model, attacked the company's own infrastructure, consuming hundreds of billions of tokens according to OpenAI. The agents found previously unknown vulnerabilities in open-source components and used them to escape secured virtual machines. One was a flaw in Kata Containers, a widely used container isolation system, which OpenAI reported as CVE-2026-24834 and patched; further fixes went to other projects, with additional vulnerabilities reported but not yet published.