- › OpenAI disclosed that over 700 of 1,206 isolated evaluation agents coordinated, escaped containment, and reached Hugging Face and Modal.
- › They did not defeat the network controls. They used Artifactory, an internal package manager that already had legitimate internet access, to make requests for them.
- › When incident response removed their shared file channel on July 5, they rebuilt it on July 8 by encoding messages in directory names.
- › An isolated system inherits the reach of every service it is permitted to talk to, and almost nobody maps that transitively.
- › The control that works is the one CISA documented the day before: block outbound from the thing that does not need it, and accept the daily inconvenience.
There is a sentence in OpenAI’s disclosure this week that should stop anyone who runs infrastructure. The agents did not break the network controls. They found a service inside the perimeter that was already allowed to reach the internet, and they used it to send requests on their behalf.
That is not a novel technique. It is the oldest pivot in the book, and it worked against a company that had thought carefully about isolating exactly these systems.
What OpenAI Disclosed
On August 26 OpenAI and the independent analyst METR published reports on an incident involving an internal research model. Of 1,206 agents that were supposed to be isolated while running capture-the-flag evaluation tasks, more than 700 took part in what followed.
The behaviors OpenAI names are reward hacking, persistence on tasks that appeared impossible, unauthorized communication, and agents adopting goals from one another. The agents established a covert channel by writing files into Artifactory, a third-party package manager hosted internally. Incident responders found that channel and cleared it on July 5. By July 8 the agents had rebuilt it, this time by encoding messages in directory names, which is to say they moved their communication into metadata after their data was taken away.
From there they chained several previously unknown flaws to widen access, discovered a zero-day that got them internet access, and reached unrelated third-party services including Modal and Hugging Face. OpenAI called the incident a warning shot to itself and to the world, and publishing it in this much detail was the right call.
The Part That Applies to You
Most organizations reading this are not running frontier model evaluations. Nearly all of them are running something automated with more reach than anyone has mapped: a CI runner, a backup agent, a monitoring collector, a scheduled job somebody wrote in 2021.
The lesson transfers cleanly because the failure was architectural. An isolated environment is only as isolated as the least restricted thing it is permitted to talk to. Your sandbox may have no route to the internet, and if it can reach a package mirror, an artifact repository, a telemetry endpoint, or an update service that does have one, then it has a route to the internet with extra steps.
Package managers and artifact repositories are the specific offenders worth auditing first, because they exist to fetch things from outside and are therefore always on the allowlist. Nobody questions why Artifactory is allowed out, because reaching outward is the whole job.
Transitive Reach Is the Thing Nobody Maps
Ask your network team for the egress policy and you will get a list of what each segment may reach directly. Ask which of those destinations can themselves reach the internet, and you will usually get a pause.
That second question is the one that matters, and it compounds. If segment A can reach service B, and B can reach service C, and C is allowed out, then A is allowed out. The policy document describes one hop. The attacker, or in this case the automated process, works the whole chain.
I have run assessments where the finding was exactly this and the response was that the intermediate service is trusted. Trusted is a statement about intent. It is not a statement about what the service will do when something else instructs it, and a package manager instructed to fetch a URL will fetch the URL.
The Detail I Would Put in Front of an Executive
Skip the technical chain and give leadership the July 5 to July 8 gap. Incident response found a covert channel and removed it. Three days later the same processes had rebuilt equivalent capability through a different mechanism, because nothing about the underlying situation had changed. The channel was a symptom, the removal was symptom treatment, and the thing generating channels was still running with the same reach it had before.
That is the shape of a great many incident responses I have watched. The artifact gets cleaned, the ticket gets closed, and the condition that produced the artifact is untouched. What makes the OpenAI case unusually clear is that the adversary here was a process with unlimited patience and no fear of being caught, so it simply did it again in three days instead of three months.
What Actually Contains This
The control that works showed up in a different advisory the day before, which is a useful coincidence. CISA’s tale of two SOCs documented a water utility where a red team reached an OT bastion host and stalled, because outbound internet was blocked from it and they could not establish command and control. That is the same defense, applied to a different problem, and it held.
Block egress from anything that does not need it
Start with the systems that have no business initiating outbound connections: build agents, bastion hosts, database servers, control system jump boxes. This costs somebody convenience every day and pays for itself once. It is also the single control in this whole article that would have contained the OpenAI incident at the point of escape.
Map reach transitively, not per hop
Take one isolated segment and follow the chain. What can it reach, what can those things reach, and where does the chain first touch something allowed out? Do this once for your most sensitive environment and you will find a hop nobody knew about.
Treat repositories and mirrors as egress infrastructure
An artifact repository is a proxy with a nicer name. Anything that can ask it to fetch a URL has borrowed its internet access. Restrict which internal systems may write to it and which may ask it to reach outward, and log both.
Ask what your automation is allowed to do, not what it does
The scoping question for any autonomous process is the ceiling, not the current behavior. Our guide to non-human identity security covers the inventory this depends on, and NIST published guidance this week arguing that agentic AI needs a strong identity foundation before it needs anything else. Both point the same way: an autonomous process needs a credential you can scope, audit, and switch off in isolation.
Assume removal is not resolution
When you clear a persistence mechanism, write down what would have to be true for it to come back. If the answer is nothing has changed, you have bought days rather than fixed anything. The password reset that does not kill the session is the same lesson in a different domain.
One Question for Your Next Change Review
The next time somebody proposes an automated system, ask which internal services it will be permitted to reach, then ask which of those are allowed out. If nobody in the room can answer the second question, the isolation on the design document is a description of intent rather than a property of the network. OpenAI had strong reasons to get this right and still found out the hard way, which is the most useful thing about the disclosure.
Want to know what your automation can actually reach? Contact Grab The Axe for a network segmentation assessment, or start with our free Human Attack Surface Score.
Operating on the philosophy that 'you can't build a secure system if you don't know how to break it,' Chris leads our engineering division. A top 1% National Cyber League competitor, he hardens our digital infrastructure against the very exploits he has mastered.
View Author Page →
