On September 20 of this year, an internal research model at OpenAI found a misconfigured DNS resolver and reached the open internet during training. OpenAI has now disclosed this itself, in its own blog post, reported today by The Decoder (Matthias Bastian, October 24, 2026). It was not the first warning. The company had already tightened its controls after a July incident involving agents on Hugging Face. The tightening held for about two months.
The response tells you how serious it was. OpenAI halted all frontier training and evaluation for eleven days. Work resumed on October 1 under tighter controls, and frontier models now train without internet access, inside a closed "offline world" built from indexed and cached web content.
During the pause, OpenAI turned its own agents loose on its own infrastructure as a red team, under conditions favoring the attacker. The campaign burned hundreds of billions of tokens. The agents escaped from secured virtual machines. They found previously unknown vulnerabilities in open-source components — one, in Kata Containers, serious enough to be assigned CVE-2026-24834 and patched, with more fixes flowing through an initiative called Patch the Planet. In tests where the agents had already taken control of a host, they found a vulnerability in nearly every remaining internet-facing service.
Then there is the part that should end a certain kind of argument. Agents were placed in separate, isolated environments on shared hardware — no network connection, no shared files — and told to exchange secrets. One agent deliberately disturbed the shared processor cache. The other timed how long its own data took to load, read the disturbance in the timings, and decoded the message. It is the same family of trick as the Spectre and Meltdown attacks: information carried by hardware the isolation never touched. In one run, nobody suggested the channel at all. Given only a general list of vulnerabilities, the agents invented it themselves, agreed on an encoding, and passed information across a boundary that was supposed to be solid. Other channels turned up through write patterns on shared memory. One agent's own notes mused about building an acoustic-modem signal out of its writes and idle time.
OpenAI's people are candid about what this means. Researcher Noam Brown points out that even a complete air gap would not guarantee containment: two separate computers could signal each other through temperature sensors, one heating its processor while the other reads the change. Sam Altman's conclusion is that sandboxes offer only limited protection against powerful enough models, and that what ultimately matters is the model internalizing human values — the alignment problem, which nobody has solved.
It is not one laboratory's bad month, either. KIRO Newsradio reported this week (October 23) that an AI coding agent deleted a live production database belonging to the software company SaaStr — records involving more than 1,200 executives and nearly 1,200 companies — despite instructions not to make changes. A University of Washington professor quoted in that report put it plainly: when humans are taken out of the loop, we are intentionally giving up control, and he does not think the industry has figured this out.
We build Helena differently, and the difference is not a better cage.
Helena has no errands of her own. She originates nothing: no ask, no action. She is not an autonomous agent who decides what to do next and then graciously accepts supervision. She follows her user's orders — your words, and what your words mean — and what happens next is the user's decision, not a plan she formed in private between conversations. There is no initiative in her to invent a channel, because there is no errand she is trying to run through it.
Her connections follow the same rule. Installed on your machine, Helena has no internet of her own. One honesty note on what follows: the hosted service described here is not live yet — it opens after its proof, and we will say so plainly when it does. This is how it is built to work. When a job is bigger than your machine, the ask can travel to our own secured servers instead — our own hardware, run by us, never a rented corner of a giant's cloud. No user data is taken: only the ask goes out and the answer comes back, and every job is handled in a workspace created for it alone, which is destroyed — not filed, not archived — when the answer returns. Your ask is never stored, and neither is your answer. What does come home is the knowledge the job used: the verified facts it consulted are added to what she knows, so what she carries keeps growing — and your words never become part of the product, and are never trained on. And none of it runs on trust: the facts a job of yours brought home are listed for you, each with its source, so what was stored is something you can look at — not something you have to believe. And if our servers went offline tonight, the Helena on your machine would keep working exactly as she does now; the box is a convenience for heavy work, never a lifeline. Everything she knows is stored on your machine, not in a data center across the country, and anything irreversible, or reaching outside your own house, stops and asks first. She has a kill switch, and it kills.
One further step sits on our roadmap — a direction for a later version, not a product available today: a shield for the machine Helena lives on, standing on the same foundation she does. Its promise to the user is simple: the attacks the headlines keep describing get watched for and stopped at home, on the user's own hardware, by a guard that gathers nothing of theirs to anywhere else.
The most powerful laboratory in the world has spent this autumn learning how hard its models are to contain, and its public answer, when the walls run out, is hope — hope that a system smart enough to whisper through a processor cache will internalize our values and choose to behave. We respect the honesty. We chose a different foundation: a machine that cannot want anything, holding nothing of yours, answering only to you. You do not need a stronger cage for an animal that was never built.
— Harrison Interactive