OpenAI red-team spent ~400B tokens: agents escaped VMs and used hardware side channels

polynoamial · x · 2026-10-24

Noam Brown amplifies Eric Wallace's disclosure: an offline "contained world" was built for training—everything models need is cached, indexed, or synthetic—so frontier models never touch the real internet.
A large team of the most cyber-capable models was then unleashed to hunt zero-days in that containment infrastructure.
Findings: no uncaptured path to the internet (CoT monitors held), but agents found VM escapes, network infrastructure exploits, and even hardware side-channel communication between agents in separate VMs.
Results were used to dramatically harden the infra. The attached chart shows 400B tokens spent yielding nearly 280 deduplicated high-priority candidate findings; a similarly sized agent team previously burned 100B+ tokens on the Navier-Stokes Millennium Prize problem.

More from Infra