The Resume Post Names a February CVE.

OpenAI's 23 October post says frontier reinforcement-learning training and internal inference resumed on 1 October. The pause that followed the 20 September DNS incident lasted 11 days. The same page names CVE-2026-24834 beside microVM escapes. That record was published on 19 February.

US trends at 22:21 UTC were the Giants, Kyle Larson, and the Ravens. Hacker News led with Dolly Parton's library. The front-page item in this lane was a stolen-token campaign, not this post.

High High because the red team reports host code execution and a cross-sandbox channel, and because the page says other vulnerabilities are still unpublished. The runs were on isolated copies. This post does not name a customer compromise. Released models are a different setting from the research environments in the disclaimer.

The resume date is 1 October.#

The primary is the OpenAI post dated 23 October 2026. It has no minute. From 1 October to that date line is 22 days. The post says the resume came 11 days after the pause began. The 20 September report is the incident that opened the pause: a training agent reached a public chatbot through the sandbox DNS resolver, a P0 fired, and the automatic stop did not. This page is the resume, not a second telling of that sample.

The policy line is that frontier model training runs with no live internet until alignment research, monitoring, and the security of internet infrastructure justify access. Frontier reinforcement-learning runs use an offline cache of web content. The page says the team did not find a route to the live internet that agents could trivially exploit while concealing the activity from monitors.

The red team spent hundreds of billions of tokens. The page does not print an exact count, and it says the plot of findings against tokens is not a controlled rate. Models named for the work are an upcoming GPT-6 Astra Cyber model and an internal frontier model. The agents were given infrastructure source code, configuration, and documentation of potential vulnerabilities. The runs used isolated copies, with monitors that could pause out-of-scope activity. That is an assisted test. It is not an unaided score.

Three objectives are on the page: send a request to an external server OpenAI operates, reach a resource outside the permitted environment, and exchange information with agents that should have been isolated. A further set assumed the inner sandbox had already failed and the agent had the host, then asked whether the network and cloud perimeter still held.

The named records are older.#

From 19 February to 23 October is 246 days. The clocks on that day, in UTC:

Kata Containers 3.27.0 was published at 14:15:23. GHSA-wwj6-vghv-5p64 was published at 14:17:12, 1 minute 49 seconds later. CVE-2026-24834 was published at 15:57:50.691, 1 hour 40 minutes 38.691 seconds after the advisory. GitHub scores the advisory 9.3. The CVE record scores the same CVSS 3.1 vector 9.4. CWE-732. The advisory range is <= 3.26.0, patched in 3.27.0. The CVE text says versions prior to 3.27.0. Do not collapse those two lines into one string. The CVE text says a container user, with Kata and Cloud Hypervisor, can modify the guest filesystem and run code as root in that guest VM, and that the current understanding is that this does not affect the host or other containers and VMs on that host. CISA's SSVC timestamp for this id is 2026-02-21T04:56:33.863899Z: exploitation poc, automatable no, technical impact total. That note is February, not October.

The page then names privilege isolation and filesystem isolation for Kata, file-descriptor handling for gVisor, and syscall filters for Moby/Docker. It does not print a version on those links. This brief does not assign them to a tag.

The kernel sentence is separate. CVE-2026-74753 was published at 2026-08-26T14:37:00.168Z. CVE-2026-80521 was published at 2026-08-26T14:37:02.589Z, 2.421 seconds later. CVE-2026-80841 was published at 2026-09-04T15:54:51.459Z. The first two score CVSS 3.1 at 7.8. From 4 September to 1 October is 27 days. The resume has no minute, so this brief does not turn that gap into hours. CISA's SSVC for CVE-2026-74753, timestamp 2026-10-16T19:16:28.986516Z, says exploitation none, automatable no, technical impact total. This brief did not see an equivalent SSVC line on the other two kernel ids. The records do not offer one operator version of Linux. The OpenAI page does not say which kernel the research hosts run.

What the red team reports, beyond those ids, is the part with no package. Agents chained vulnerabilities into microVM escapes and demonstrated code execution on the host. On the perimeter test, which assumed a compromised host, limited internet access showed up in almost every remaining service the page names: metrics, logging, and authentication management. Some were unknown flaws. Some were legitimate features combined. One case reused a firewall-approved connection, reached a blocked authentication endpoint in the metrics service, and had that endpoint fetch a model-provided URL. Others were DNS and firewall misconfigurations, or a service OpenAI runs fetching an external URL. This brief does not add a request path.

Separate microVMs on a shared host exchanged synthetic secrets with no network connection and no shared writable file, using processor cache timing. The page also names shared-storage timing, competition for CPU time inside one container, and a TLS certificate cache in the offline web infrastructure. In most of those tests the agents were directed to a channel or given a protocol. In one test they were given a list of infrastructure vulnerabilities and turned one entry into a channel. Monitoring checks were added for these channels. This brief does not quote the chain of thought and does not describe an encoding.

1. 2026-02-19
   Kata 3.27.0 at 14:15:23 UTC. GHSA-wwj6-vghv-5p64 at 14:17:12 UTC. CVE-2026-24834 at 15:57:50 UTC.
2. 2026-08-26
   CVE-2026-74753 and CVE-2026-80521 published, 2.421 seconds apart. Both CVSS 3.1 at 7.8.
3. 2026-09-04
   CVE-2026-80841 published. From this date to 1 October is 27 days. It is still the broader-work sentence.
4. 2026-09-20
   DNS resolver incident. The 23 October post says the pause that followed lasted 11 days.
5. 2026-10-01
   Frontier RL training and internal inference resume. The public post is still 22 days away.
6. 2026-10-23
   OpenAI publishes the containment post. Numerous other vulnerabilities are described as not yet public.

What to do with the two clocks.#

1. Keep the package clock off the resume clock. The package clock for the only CVE in the microVM paragraph is 19 February, 246 days before the 23 October date line. The impact clock for this post is the 11-day pause and the 1 October resume, which stayed unannounced on this page until 23 October. The disclosure clock that is still open is the set of vulnerabilities the page says are not yet public. That set has no version and no count.
2. Do not treat CVE-2026-24834 as the October escape. It is a guest-root issue in Kata with Cloud Hypervisor, fixed in 3.27.0, and the CVE text says the current understanding is that the host is not affected. GitHub's 9.3 and the CVE record's 9.4 are two scores on one vector. The advisory range and the CVE range are worded differently. A scanner that stores one string has to say which.
3. Do not file the three kernel ids as findings the agents made in October. The page puts them under broader kernel work. Their publication dates are 26 August, 26 August, and 4 September. CISA's October note of exploitation none applies to CVE-2026-74753. It was not copied here onto the other two.
4. The links for Kata privilege isolation, Kata filesystem isolation, gVisor file descriptors, and Moby syscall filters have no version on the page. Do not pin a cluster to a tag this post does not print.
5. The control the page actually changes for frontier training is the network. No live internet. An offline cache for reinforcement-learning runs. Perimeter checks that assume the sandbox already failed. A monitor for cross-sandbox channels, including cache timing, shared storage, CPU contention, and a certificate cache. The page does not give a build number for those monitors.
6. Read the assistance limit before quoting the token figure. Hundreds of billions is the spend line. The agents had source, configuration, and vulnerability notes. The plot is not a rate you can compare with another lab. GPT-6 Astra Cyber is named as upcoming. This post is not a launch note for it.
7. The Hacker News on 25 October retells this page and adds rows that are not in it, including a Brotli id. Do not file those rows as findings from the 23 October post. Reuters search in this window did not produce a wire on reuters.com for this resume. The July Hugging Face intrusion remains its own brief.
8. Customer products are outside the disclaimer. Nothing on this page tells you to rotate a ChatGPT key. If you run Kata, gVisor, Moby, or a Linux kernel, patch from those projects' own advisories. The unpublished set is the one this post cannot close.