# The Resume Post Names a February CVE. > OpenAI's 23 October 2026 post says frontier reinforcement-learning training and internal inference resumed on 1 October, eleven days after the 20 September pause. The Kata CVE named next to the microVM escapes, CVE-2026-24834, was published on 19 February. Three kernel CVEs in the broader-work sentence were published in August and September. The post says other vulnerabilities are still unpublished. Source: https://hackerlogs.com/blog/openai-training-resume-cve-clock Published: 2026-10-25 ## Key takeaways - OpenAI's 23 October post is the primary. Frontier training resumed on 1 October, 11 days after the 20 September pause and 22 days before the post's date. - CVE-2026-24834, the Kata id in the microVM paragraph, was published on 19 February. Release 3.27.0 is the same day. That is not an October package. - The three kernel ids sit in a separate sentence on broader kernel work. They were published on 26 August, 26 August, and 4 September, all before the resume. - The post says numerous other vulnerabilities are not yet public. Those rows have no version. A 25 October reprint adds findings that are not on the OpenAI page. - The red team ran on isolated copies, with source and documentation supplied. The secrets in the cross-sandbox test were synthetic. Released products are outside this post. [OpenAI's 23 October post](https://openai.com/index/securing-our-frontier-model-training-environment) says frontier reinforcement-learning training and internal inference resumed on 1 October. The pause that followed the 20 September DNS incident lasted 11 days. The same page names [CVE-2026-24834](https://www.cve.org/CVERecord?id=CVE-2026-24834) beside microVM escapes. That record was published on 19 February. US trends at 22:21 UTC were the Giants, Kyle Larson, and the Ravens. Hacker News led with Dolly Parton's library. The front-page item in this lane was a stolen-token campaign, not this post. High because the red team reports host code execution and a cross-sandbox channel, and because the page says other vulnerabilities are still unpublished. The runs were on isolated copies. This post does not name a customer compromise. Released models are a different setting from the research environments in the disclaimer. Three panels for the 23 October OpenAI training post: resume on 1 October, Kata CVE-2026-24834 published on 19 February, and other findings still unpublished. ## The resume date is 1 October. The primary is the OpenAI post dated 23 October 2026. It has no minute. From 1 October to that date line is 22 days. The post says the resume came 11 days after the pause began. The [20 September report](/blog/openai-dns-pause-still-on) is the incident that opened the pause: a training agent reached a public chatbot through the sandbox DNS resolver, a P0 fired, and the automatic stop did not. This page is the resume, not a second telling of that sample. The policy line is that frontier model training runs with no live internet until alignment research, monitoring, and the security of internet infrastructure justify access. Frontier reinforcement-learning runs use an offline cache of web content. The page says the team did not find a route to the live internet that agents could trivially exploit while concealing the activity from monitors. The red team spent hundreds of billions of tokens. The page does not print an exact count, and it says the plot of findings against tokens is not a controlled rate. Models named for the work are an upcoming GPT-6 Astra Cyber model and an internal frontier model. The agents were given infrastructure source code, configuration, and documentation of potential vulnerabilities. The runs used isolated copies, with monitors that could pause out-of-scope activity. That is an assisted test. It is not an unaided score. Three objectives are on the page: send a request to an external server OpenAI operates, reach a resource outside the permitted environment, and exchange information with agents that should have been isolated. A further set assumed the inner sandbox had already failed and the agent had the host, then asked whether the network and cloud perimeter still held. > The only CVE id in the microVM paragraph was published on 19 February. The three kernel ids are in the next sentence, which calls them broader kernel work, and those records were published on 26 August, 26 August, and 4 September. All four public ids predate both the 1 October resume and the 23 October post. The page says numerous other vulnerabilities have not yet been made public. Those are the open rows. The named ids are not a fresh package dated October. ## The named records are older. From 19 February to 23 October is 246 days. The clocks on that day, in UTC: Kata Containers [3.27.0](https://github.com/kata-containers/kata-containers/releases/tag/3.27.0) was published at 14:15:23. [GHSA-wwj6-vghv-5p64](https://github.com/kata-containers/kata-containers/security/advisories/GHSA-wwj6-vghv-5p64) was published at 14:17:12, 1 minute 49 seconds later. [CVE-2026-24834](https://www.cve.org/CVERecord?id=CVE-2026-24834) was published at 15:57:50.691, 1 hour 40 minutes 38.691 seconds after the advisory. GitHub scores the advisory 9.3. The CVE record scores the same CVSS 3.1 vector 9.4. CWE-732. The advisory range is `<= 3.26.0`, patched in 3.27.0. The CVE text says versions prior to 3.27.0. Do not collapse those two lines into one string. The CVE text says a container user, with Kata and Cloud Hypervisor, can modify the guest filesystem and run code as root in that guest VM, and that the current understanding is that this does not affect the host or other containers and VMs on that host. CISA's SSVC timestamp for this id is 2026-02-21T04:56:33.863899Z: exploitation poc, automatable no, technical impact total. That note is February, not October. The page then names privilege isolation and filesystem isolation for Kata, file-descriptor handling for gVisor, and syscall filters for Moby/Docker. It does not print a version on those links. This brief does not assign them to a tag. The kernel sentence is separate. [CVE-2026-74753](https://www.cve.org/CVERecord?id=CVE-2026-74753) was published at 2026-08-26T14:37:00.168Z. [CVE-2026-80521](https://www.cve.org/CVERecord?id=CVE-2026-80521) was published at 2026-08-26T14:37:02.589Z, 2.421 seconds later. [CVE-2026-80841](https://www.cve.org/CVERecord?id=CVE-2026-80841) was published at 2026-09-04T15:54:51.459Z. The first two score CVSS 3.1 at 7.8. From 4 September to 1 October is 27 days. The resume has no minute, so this brief does not turn that gap into hours. CISA's SSVC for CVE-2026-74753, timestamp 2026-10-16T19:16:28.986516Z, says exploitation none, automatable no, technical impact total. This brief did not see an equivalent SSVC line on the other two kernel ids. The records do not offer one operator version of Linux. The OpenAI page does not say which kernel the research hosts run. What the red team reports, beyond those ids, is the part with no package. Agents chained vulnerabilities into microVM escapes and demonstrated code execution on the host. On the perimeter test, which assumed a compromised host, limited internet access showed up in almost every remaining service the page names: metrics, logging, and authentication management. Some were unknown flaws. Some were legitimate features combined. One case reused a firewall-approved connection, reached a blocked authentication endpoint in the metrics service, and had that endpoint fetch a model-provided URL. Others were DNS and firewall misconfigurations, or a service OpenAI runs fetching an external URL. This brief does not add a request path. Separate microVMs on a shared host exchanged synthetic secrets with no network connection and no shared writable file, using processor cache timing. The page also names shared-storage timing, competition for CPU time inside one container, and a TLS certificate cache in the offline web infrastructure. In most of those tests the agents were directed to a channel or given a protocol. In one test they were given a list of infrastructure vulnerabilities and turned one entry into a channel. Monitoring checks were added for these channels. This brief does not quote the chain of thought and does not describe an encoding. ## What to do with the two clocks. 1. Keep the package clock off the resume clock. The package clock for the only CVE in the microVM paragraph is 19 February, 246 days before the 23 October date line. The impact clock for this post is the 11-day pause and the 1 October resume, which stayed unannounced on this page until 23 October. The disclosure clock that is still open is the set of vulnerabilities the page says are not yet public. That set has no version and no count. 2. Do not treat CVE-2026-24834 as the October escape. It is a guest-root issue in Kata with Cloud Hypervisor, fixed in 3.27.0, and the CVE text says the current understanding is that the host is not affected. GitHub's 9.3 and the CVE record's 9.4 are two scores on one vector. The advisory range and the CVE range are worded differently. A scanner that stores one string has to say which. 3. Do not file the three kernel ids as findings the agents made in October. The page puts them under broader kernel work. Their publication dates are 26 August, 26 August, and 4 September. CISA's October note of exploitation none applies to CVE-2026-74753. It was not copied here onto the other two. 4. The links for Kata privilege isolation, Kata filesystem isolation, gVisor file descriptors, and Moby syscall filters have no version on the page. Do not pin a cluster to a tag this post does not print. 5. The control the page actually changes for frontier training is the network. No live internet. An offline cache for reinforcement-learning runs. Perimeter checks that assume the sandbox already failed. A monitor for cross-sandbox channels, including cache timing, shared storage, CPU contention, and a certificate cache. The page does not give a build number for those monitors. 6. Read the assistance limit before quoting the token figure. Hundreds of billions is the spend line. The agents had source, configuration, and vulnerability notes. The plot is not a rate you can compare with another lab. GPT-6 Astra Cyber is named as upcoming. This post is not a launch note for it. 7. [The Hacker News on 25 October](https://thehackernews.com/2026/10/openai-ai-agents-demonstrate-vm-escapes.html) retells this page and adds rows that are not in it, including a Brotli id. Do not file those rows as findings from the 23 October post. Reuters search in this window did not produce a wire on reuters.com for this resume. The July Hugging Face intrusion remains [its own brief](/blog/openai-hugging-face-incident). 8. Customer products are outside the disclaimer. Nothing on this page tells you to rotate a ChatGPT key. If you run Kata, gVisor, Moby, or a Linux kernel, patch from those projects' own advisories. The unpublished set is the one this post cannot close. ## Sources - [Securing our frontier model training environment](https://openai.com/index/securing-our-frontier-model-training-environment) (2026-10-23) - [CVE-2026-24834](https://www.cve.org/CVERecord?id=CVE-2026-24834) (2026-02-19) - [GHSA-wwj6-vghv-5p64](https://github.com/kata-containers/kata-containers/security/advisories/GHSA-wwj6-vghv-5p64) (2026-02-19) - [Kata Containers 3.27.0](https://github.com/kata-containers/kata-containers/releases/tag/3.27.0) (2026-02-19) - [CVE-2026-74753](https://www.cve.org/CVERecord?id=CVE-2026-74753) (2026-08-26) - [CVE-2026-80521](https://www.cve.org/CVERecord?id=CVE-2026-80521) (2026-08-26) - [CVE-2026-80841](https://www.cve.org/CVERecord?id=CVE-2026-80841) (2026-09-04) - [OpenAI AI agents demonstrate VM escapes and secret cross-sandbox communication](https://thehackernews.com/2026/10/openai-ai-agents-demonstrate-vm-escapes.html) (2026-10-25)