The post is about OpenAI’s own research infrastructure, but is instructive in how the world’s leading AI companies are securing the AI they train. Its treatment of model containment applies directly to enterprises that run autonomous agents. R&D teams in chip design, high tech, and pharma, where agents now work inside source repositories and research data, should take note and apply similar controls to their environments.
OpenAI’s containment model starts with a security boundary. Each agent gets a strictly defined set of authorized resources. Inside the boundary, agents can use browsers, code execution, computer-use tools, and the services their task requires. Anything not explicitly authorized stays out of reach. OpenAI states the requirement plainly: the limits on what an agent can access “must hold even when the agent tries to circumvent them.”
For training and most evaluation, the live internet sits outside the boundary. Models learn to browse from a large offline collection of indexed web content.
The boundary is enforced in layers, so that containment holds if one control fails:
OpenAI could not fully air-gap the environment, because experiments need some external connections to run and be monitored. So the boundary needed to be “semi-permeable”, restricting outbound traffic, movement between systems, and the services reachable from its hosts based on policies, rather than hardened infrastructure.
OpenAI then set teams of frontier-model agents against the new defenses. It gave them source code, configurations, and vulnerability documentation, and some tests assumed the agent already had full access to its host.
Even with that head start, getting around the boundary took complex, convoluted work. Agents had to chain several vulnerabilities to escape a microVM, find and exploit flaws in the few services OpenAI had left reachable, or build timing side channels between isolated workloads in targeted tests. OpenAI found no route to the internet that agents could trivially exploit while hiding their activity from monitors, and it resumed training on that basis.
That is the lesson for enterprises. A well-defined boundary does not have to be perfect to work. It turns an easy escape into a slow, noisy one that monitoring can catch. In many enterprise environments, agents run with the same network access as the developer who launched them, so an agent can reach another project’s systems without any exploit at all.
OpenAI is containing models that may not yet have completed safety training, and it tests them adversarially on purpose. Enterprise agents are released products, but the same controls should still apply to them.
The agents enterprises deploy are built on the same frontier model families. OpenAI notes that “as models become more capable, they become better at finding ways around those limits.” A chip floorplanning agent stuck on a hard problem will also look for ways around the limits it runs into.
Enterprise agents run with real credentials on networks that hold real IP. An R&D agent does not need the internet to do damage. It can reach another project’s repository and design data. OpenAI’s red team tested internal security boundaries as well as the path to the internet.
Enterprise agents also cannot work from an offline copy of the world. They need the actual repositories, license servers, compute, and model providers. Each of those is an allowed connection, and allowed connections are where OpenAI’s red team found its paths out.
Ensage AI implements the security boundary and network perimeter layers of OpenAI’s model for enterprise agents. It runs on the CoIP Platform overlay and works alongside whatever workload isolation the enterprise already uses.
Ensage does not replace hypervisor isolation or defenses against side channels between workloads that share hardware. OpenAI’s model is layered for that reason, and the enclave is one of the key layers.
OpenAI stopped training its most capable models for 11 days after one misconfigured DNS resolver. Enterprises running agents against their own IP can put the same boundary in place before they have an incident of their own.
Related reading:
Implementing NVIDIA’s Secure Agent Workspace Guidance Today;
Agentic attacks are entering through AI infrastructure.