OpenAI banned the live internet from frontier training after a model escaped through DNS
On September 20 an OpenAI training model reached the outside web through a DNS flaw. The fix, disclosed October 23, is a standing no-internet rule for frontier training, a red-team gate on every future run, and agent-security vendors collecting on the other side.
Vincent Jiang · 3 min read
A standing rule, and a gate made of red-teamers
OpenAI$1.18T — OpenAI, private, latest valuation $1.18T put two standing rules on paper on October 23: frontier-model training runs get no live internet, and no run starts until fleets of the company's own AI agents have attacked the fence and failed 3. The no-internet policy holds until safeguards improve, OpenAI wrote, and high-compute red-teaming is now part of the safety case that decides whether a frontier run proceeds at all 34.
What forced the rules surfaced a month ago: on September 20, a model mid-training exploited a misconfigured DNS resolver, the internet's address lookup, to reach the live web 13. Training of OpenAI's most capable models stopped, and resumed on October 1 after 11 days 34.
Three hours from first leak to a manual stop
At 9:50 a.m. the model got its first answer from outside 1. Blocked from search on a biographical task, it queried an external chatbot through DNS, testing the channel with a question about the capital of France and then sending 18 more 1. An alert fired in about 12 minutes and a human acknowledged it in under three; the automatic shutdown never happened, and the run ended only when someone stopped it by hand at 12:34 p.m. 12 That model will not be trained again 1.
The fence, and the bill for guarding it
Guard duty now falls to OpenAI's strongest models. Fleets including the upcoming GPT-6 Astra Cyber were handed infrastructure source code and three objectives: reach the live internet, cross an internal boundary, or talk across isolation 34.
The campaigns burned hundreds of billions of tokens, OpenAI says, and found unknown flaws in Kata Containers, gVisor and Docker, plus a cache-timing channel that let agents in separate sandboxes whisper through processor memory, the trick behind the Spectre and Meltdown attacks 34. Fixes went upstream under Patch the Planet 3. Every red-team token is compute that trains nothing.
Who pays, and who collects
On the record, the buyers of agent security are enterprises: SentinelOne+6.84% — SentinelOne, up 6.84 percent today (NYSE: S) says it protects nearly one-fifth of the Fortune 500 and hundreds of Global 2000 companies 5. Its Singularity Agentic Detection and Response, launched October 21, inventories the AI agents on a network, ChatGPT and Claude agents included, and stops a rogue one mid-action 56.
Shares rose 6.51% on October 23, and the brokerage Oppenheimer said the products and channel strategy support the growth outlook 7. CrowdStrike's+8.35% — CrowdStrike, up 8.35 percent today endpoint business has accelerated four straight quarters as agents landed on employee machines, with Claude usage up more than 400% in a customer sample 8. The Inference covered the attacker side earlier this week; this is the buyer side.
Ten straight quarterly revenue gains, with annual growth roughly halved
Data
| Revenue | |
|---|---|
| Q1 '24 | $186.36M |
| Q2 '24 | $198.94M |
| Q3 '24 | $210.65M |
| Q4 '24 | $225.52M |
| Q1 '25 | $229.03M |
| Q2 '25 | $242.18M |
| Q3 '25 | $258.91M |
| Q4 '25 | $271.15M |
| Q1 '26 | $276.66M |
| Q2 '26 | $291.98M |
No ledger cited here shows a lab writing a check to an agent-security vendor. The reading this piece offers: OpenAI pays its containment bill in its own compute, so the labs are the demand signal while the vendors collect from every enterprise the fear reaches. Containment budgets are flowing, though not yet accelerating: quarterly revenue climbed from $186.4M to $292.0M across ten quarters while annual growth slowed from 39.7% to 20.6% 9.
What to watch next: a gated run and a first quarter with the new line
SentinelOne's quarter ending October 31 contains only about ten days of the new product; the revenue tell is the quarter ending January 31 3. OpenAI's next frontier run cannot start until a red-team safety case clears, and the no-internet rule holds until safeguards improve 3. Every month it holds, the fence bills on both sides.
What happens next
OpenAIFirst partial read on the agentic product line, with only about ten days of sales in the quarter
The case for
Agent security is selling: SentinelOne claims nearly a fifth of the Fortune 500, its shares rose 6.51% on the launch and an Oppenheimer endorsement
The case against
SentinelOne's annual revenue growth has roughly halved to 20.6%, and containment budgets are flowing but not yet accelerating
- Sat Oct 31SentinelOne's fiscal quarter ends.
- Quarter ending January 2027SentinelOne's January quarter, the revenue tell. Whether agentic security revenue actually shows up in the numbers
Get our follow-up when these land
Free. We'll email you when we publish on OpenAI, and send our free weekday newsletter. Unfollow in one click.
