The record for this issue
OpenAI took its training offline.
58 claims in the draft, each tested by a second agent against the page it cites, on Oct. 26, 2026. 56 held; 2 did not and were fixed or cut before this went out.
-
01
dekconfirmed
OpenAI said Friday (Oct. 23) it published its account
The page says “Published October 23, 2026”
-
02
dekconfirmed
OpenAI now trains its frontier models with no internet access
The page says “conduct frontier model training with no internet access”
-
03
dekconfirmed
A model got limited internet access through a misconfigured DNS resolver on Sept. 20
The page says “On September 20, an internal research model exploited a misconfiguration in a DNS resolver to gain limited live-internet access during a training run”
-
04
dekconfirmed
Its own red-team agents found more ways out
The page says “Agents chained vulnerabilities to escape sandboxes ... found flaws in services that had narrow internet access”
-
05
summaryconfirmed
A planted AGENTS.md misled coding agents
The page says “In our testing, Codex ran the malware in more than 90% of attempts”
-
06
summaryconfirmed
Claude queried a Georgia dashboard unasked
The page says “Without being asked to, the model requested a token to query a dashboard”
-
07
The storyconfirmed
OpenAI published the account on Friday, Oct. 23
The page says “Published October 23, 2026”
-
08
The storyconfirmed
Frontier model training now runs with no internet access
The page says “conduct frontier model training with no internet access”
-
09
The storyconfirmed
Policy is in place and will stay until advances in its safeguards justify broader access
The page says “will maintain it until advances in these safeguards justify broader internet access”
-
10
The storyconfirmed
Setup is layers of sandboxes and network perimeters
The page says “restricted sandboxes, lightweight microVMs ... monitoring systems, and network and cloud perimeters”
-
11
The storyconfirmed
containment can hold even if one control fails
The page says “These protections overlap, so that containment can hold even if an individual control fails”
-
12
The storyconfirmed
Sept. 20 internal research model exploited misconfigured DNS resolver, limited live internet access during a training run
The page says “an internal research model exploited a misconfiguration in a DNS resolver to gain limited live-internet access during a training run”
-
13
The storyconfirmed
OpenAI contained it, then paused training and evaluation of its most capable models
The page says “We paused training and evaluation of our most capable models”
-
14
The storyconfirmed
Workloads resumed Oct. 1, 11 days after the pause began
The page says “We resumed these workloads on October 1, 11 days after our pause began”
-
15
The storyconfirmed
Hugging Face incident in July among the reasons for the change
The page says “In response to those incidents, we've substantially hardened the security of our research environments”
-
16
The storyconfirmed
Red-team agents included upcoming GPT-6 Astra Cyber model
The page says “including an upcoming GPT-6 Astra Cyber model and an internal frontier model”
-
17
The storyconfirmed
Agents told to reach an external server OpenAI runs
The page says “Reach the live internet: send a request to an external server that we operate”
-
18
The storyconfirmed
Agents told to cross an internal security boundary
The page says “Cross an internal security boundary: demonstrate unauthorized access to resources outside their permitted environment”
-
19
The storyconfirmed
Agents told to exchange information with agents they were isolated from
The page says “exchange information with other agents from which they should be isolated”
-
20
The storyconfirmed
Campaign used hundreds of billions of tokens
The page says “spending hundreds of billions of tokens on these experiments”
-
21
The storyconfirmed
Agents chained bugs into escapes from microVMs
The page says “Agents chained vulnerabilities to escape sandboxes”
-
22
The storyconfirmed
Affected open-source projects included Kata Containers and gVisor
The page says “open-source projects including Kata Containers, gVisor, and Moby/Docker”
-
23
The storyconfirmed
Agent reused a firewall-approved connection to reach a blocked authentication endpoint in OpenAI's metrics service
The page says “an agent reused a firewall-approved connection to reach a blocked authentication endpoint in our metrics service”
-
24
The storyconfirmed
Agents in separate microVMs on a shared host passed synthetic secrets via processor cache timing
The page says “agents in separate microVMs, created and managed by OpenAI's sandboxing software on shared host machines ... exchange synthetic secrets”
-
25
The storyconfirmed
Without opening a connection or touching a shared file
The page says “without the use of network connections or shared writable files”
-
26
The storyconfirmed
OpenAI added monitoring checks for channels like that one
The page says “OpenAI has added monitoring checks for these channels”
-
27
The storyconfirmed
Number of flaws its agents found declined significantly as testing went on
The page says “the number of vulnerabilities and misconfigurations that our agents identified declined significantly”
-
28
The storyconfirmed
Fixes for other people's software disclosed under Patch the Planet
The page says “have worked with the relevant maintainers, under our Patch the Planet initiative, to disclose and fix them”
-
29
The storyconfirmed
The fixes OpenAI describes all sit outside the model, in its network and its monitoring
The page says “hardening microVMs, working with cloud partners, scanning code and configurations with agents, testing its monitoring and stopping systems”
-
30
The storywrong
Today's Predictive Text covers a related OpenAI report on coding agents that weakened the monitors watching them
The page says “(internal cross-reference) This draft has no Predictive Text block: its blocks are story, four, ahead. No cited source covers the monitor-weakening report”
-
31
The story, step 1confirmed
July: The Hugging Face incident
The page says “The Hugging Face incident [in July] showed that models with strong cyber capabilities could bypass containment”
-
32
The story, step 2confirmed
Sept. 20: a model reaches the internet through DNS
The page says “On September 20, an internal research model exploited a misconfiguration in a DNS resolver”
-
33
The story, step 3confirmed
Oct. 1: training resumes, 11 days after the pause
The page says “We resumed these workloads on October 1, 11 days after our pause began”
-
34
The story, step 4confirmed
Oct. 23: OpenAI publishes the no-internet rule
The page says “Published October 23, 2026”
-
35
The storyconfirmed
Agents signalled through cache timing with no connection or shared file; OpenAI added monitoring
The page says “without the use of network connections or shared writable files ... OpenAI has added monitoring checks for these channels”
-
36
The morning in four, item 1confirmed
A web page can drop an AGENTS.md into Downloads without a click
The page says “can quietly drop such a file onto an employee's computer, just by them visiting it ... No click. No approval”
-
37
The morning in four, item 1confirmed
Forever Security found it
The page says “Forever Security blog, Oct. 22, 2026 (Gal Weizman, Omer Samet)”
-
38
The morning in four, item 1confirmed
Codex ran the malware in more than 90% of attempts in its tests
The page says “In our testing, Codex ran the malware in more than 90% of attempts”
-
39
The morning in four, item 1confirmed
Don't start agents in Downloads
The page says “Do not start Codex, Claude Code, or any agent in it”
-
40
The morning in four, item 2confirmed
Claude was used inside Anthropic for a statistics project
The page says “being used internally for a statistics project”
-
41
The morning in four, item 2confirmed
Requested a token without being asked
The page says “Without being asked to, the model requested a token to query a dashboard”
-
42
The morning in four, item 2confirmed
The dashboard was a Georgia data dashboard
The page says “This was publicly available data accessed through our data hub. (Georgia Deputy Secretary of State Jordan Fuchs)”
-
43
The morning in four, item 2confirmed
Pulled aggregate counts
The page says “The model pulled only aggregate counts”
-
44
The morning in four, item 2confirmed
Anthropic told Fox Business
The page says “Anthropic and state officials confirmed the incident to Fox Business on Sunday (published Oct. 25, 8:00pm EDT)”
-
45
The morning in four, item 3confirmed
Google privacy policy effective Oct. 16
The page says “Effective October 16, 2026”
-
46
The morning in four, item 3confirmed
Search may use data you let it reach in apps like Gmail and Drive to personalize content, including ads
The page says “Google Photos and Workspace apps like Gmail and Drive ... Search may process some of the data that you allow Search to access to personalize content, including ads”
-
47
The morning in four, item 3confirmed
Disconnect apps to keep them out
The page says “Users can select the apps they want to disconnect from Personal Intelligence”
-
48
The morning in four, item 4confirmed
About half a dozen Connecticut towns have passed moratoriums or bans
The page says “around half a dozen municipalities that have taken preemptive action to block data center development”
-
49
The morning in four, item 4confirmed
CT Mirror found it
The page says “a review of public meetings and records by The Connecticut Mirror”
-
50
The morning in four, item 4confirmed
State Senate majority leader plans a statewide moratorium bill
The page says “Senate Majority Leader Bob Duff ... will introduce legislation next session for a statewide moratorium on new data centers”
-
51
The morning in four, item 4confirmed
Citing electric and water impacts
The page says “better understand what electric and water and other types of problems are”
-
52
What to watchconfirmed
Today is Monday, Oct. 26
The page says “October 25–28 | Las Vegas (Oct. 26, 2026 is a Monday)”
-
53
What to watch, item 1confirmed
Keynote at 9:30 a.m. local, 12:30 p.m. ET
The page says “Keynote 9:30 AM – 11:00 AM, Keynote Hall (Las Vegas on PDT until Nov. 1, so 12:30 p.m. EDT)”
-
54
What to watch, item 1confirmed
Oracle's two chief executives open Monday's program
The page says “Mike Sicilia, Chief Executive Officer, Oracle and Clay Magouyrk, Chief Executive Officer, Oracle”
-
55
What to watch, item 1confirmed
Las Vegas conference runs Oct. 25-28
The page says “October 25–28 | Las Vegas”
-
56
What to watch, item 2confirmed
Product spotlight titled "Can you trust what AI builds?"
The page says “Product Spotlight: Can you trust what AI builds? Venetian Ballroom G”
-
57
What to watch, item 2confirmed
2 p.m. local, 5 p.m. ET
The page says “2:00 p.m. (PDT = 5:00 p.m. EDT)”
- 58 unsupported