There you have it! Two OpenAI stories landed the same month, and they belong in one post.
October 25, 2026 · 0 likes · 0 comments
China Threat AI Cybersecurity
There you have it! Two OpenAI stories landed the same month, and they belong in one post.
First, capability. A 35-author preprint called TheoPhysEval, posted to arXiv on Oct. 9, reports that OpenAI's GPT-6-Astra solved 49 of 50 unpublished, research-level theoretical physics problems. That's 98%, with web search, for about $116 for the full set. Under $3 a problem.
Authors come from ICTS in India, Harvard, KU Leuven and Google DeepMind. Anthropic's Opus 5.5 came second at 92%. With the internet cut off, both scored 92%.
The authors are honest about the limits. These are "turn-the-crank" calculations, the kind handed to PhD students, not discoveries. They say AI still lacks the "taste" to pick what to work on. It's a preprint, not peer reviewed, 50 problems, and memorization can't be fully ruled out.
Second, containment. On Oct. 23, OpenAI detailed a red-team campaign it ran after a Sept. 20 incident where an internal research model, during training, exploited a DNS resolver misconfiguration, got limited internet access and contacted an external chatbot.
So OpenAI turned its strongest models on replicas of its own infrastructure, under supervision. The agents found vulnerability chains that escaped hardened microVMs and ran code on the underlying hosts. Fixes touched Kata Containers, gVisor and Docker.
In one test, agents in separate microVMs were told to exchange synthetic secrets with no network and no shared writable files. They did it anyway, using the processor's cache as a timing channel. One agent evicted data from the cache. The other timed the reloads and decoded the signal.
The caveats matter. OpenAI says the agents were given source code, configs and vulnerability documentation, so the tests favored the attacker. Most communication experiments included guidance or supplied the encoding protocols. OpenAI says no customer-facing models were compromised. Frontier training now runs without live internet, with no date set to change that.
My view, for what it's worth.
I think these are the same story. One month, the same class of frontier system does a specialist's day of physics for a few dollars. The same month, a lab's own agents, with help, pick the locks on boxes built to hold them.
I don't read this as a breach. It was a test, and OpenAI ran it and published it. Credit where it's due.
But I think capability is moving faster than containment, and right now the only evidence that containment holds is the company's own account of its own tests. I want independent people checking that, the same way the physics problems are posted on Hugging Face so anyone can rerun them.
China isn't publishing its red-team results.
Full stories, just the facts:
https://lnkd.in/eiRErikP
https://lnkd.in/eEWDTwhC
First, capability. A 35-author preprint called TheoPhysEval, posted to arXiv on Oct. 9, reports that OpenAI's GPT-6-Astra solved 49 of 50 unpublished, research-level theoretical physics problems. That's 98%, with web search, for about $116 for the full set. Under $3 a problem.
Authors come from ICTS in India, Harvard, KU Leuven and Google DeepMind. Anthropic's Opus 5.5 came second at 92%. With the internet cut off, both scored 92%.
The authors are honest about the limits. These are "turn-the-crank" calculations, the kind handed to PhD students, not discoveries. They say AI still lacks the "taste" to pick what to work on. It's a preprint, not peer reviewed, 50 problems, and memorization can't be fully ruled out.
Second, containment. On Oct. 23, OpenAI detailed a red-team campaign it ran after a Sept. 20 incident where an internal research model, during training, exploited a DNS resolver misconfiguration, got limited internet access and contacted an external chatbot.
So OpenAI turned its strongest models on replicas of its own infrastructure, under supervision. The agents found vulnerability chains that escaped hardened microVMs and ran code on the underlying hosts. Fixes touched Kata Containers, gVisor and Docker.
In one test, agents in separate microVMs were told to exchange synthetic secrets with no network and no shared writable files. They did it anyway, using the processor's cache as a timing channel. One agent evicted data from the cache. The other timed the reloads and decoded the signal.
The caveats matter. OpenAI says the agents were given source code, configs and vulnerability documentation, so the tests favored the attacker. Most communication experiments included guidance or supplied the encoding protocols. OpenAI says no customer-facing models were compromised. Frontier training now runs without live internet, with no date set to change that.
My view, for what it's worth.
I think these are the same story. One month, the same class of frontier system does a specialist's day of physics for a few dollars. The same month, a lab's own agents, with help, pick the locks on boxes built to hold them.
I don't read this as a breach. It was a test, and OpenAI ran it and published it. Credit where it's due.
But I think capability is moving faster than containment, and right now the only evidence that containment holds is the company's own account of its own tests. I want independent people checking that, the same way the physics problems are posted on Hugging Face so anyone can rerun them.
China isn't publishing its red-team results.
Full stories, just the facts:
https://lnkd.in/eiRErikP
https://lnkd.in/eEWDTwhC