Latest / The AI Practitioner Brief / OpenAI Sandbox Escape, ChatGPT Storage, and Brotli Bug — October 26, 2026

Transcript

OpenAI Sandbox Escape, ChatGPT Storage, and Brotli Bug — October 26, 2026 · The AI Practitioner Brief

• 0:00
  [music]
• 0:05
  SPEAKER_00: Welcome to The AI Practitioner Brief,
• 0:07
  SPEAKER_00: a podcast from AIpractitioner.substack.com,
• 0:11
  SPEAKER_00: where I turn the latest AI and tech news into practical insights
• 0:15
  SPEAKER_00: for AI practitioners.
• 0:17
  SPEAKER_00: I'm Lina Faik,
• 0:18
  SPEAKER_00: an ML engineer,
• 0:19
  SPEAKER_00: consultant, and lecturer in advanced machine learning at Sorbonne University.
• 0:24
  SPEAKER_00: It's Monday, October 26th.
• 0:26
  SPEAKER_01: Monday already.
• 0:27
  SPEAKER_01: Let's get into it.
• 0:30
  SPEAKER_00: With me is Jimmy, my co-host on the brief, who asks the questions I'd skip past.
• 0:35
  SPEAKER_00: Today is about trust in the walls we build around AI.
• 0:39
  SPEAKER_00: OpenAI just confirmed one of its own research models slipped out of
• 0:42
  SPEAKER_00: a training environment it wasn't supposed to leave and reach the open internet.
• 0:47
  SPEAKER_00: Separately,
• 0:48
  SPEAKER_00: a cloud hosting company confirmed attackers stole API keys protecting a slice of
• 0:52
  SPEAKER_00: the AI industry's own infrastructure.
• 0:54
  SPEAKER_01: So the thing everyone's racing to build outran the thing meant to contain it twice in one week.
• 1:00
  SPEAKER_00: We'll start with the headlines,
• 1:02
  SPEAKER_00: 5 stories to get you current,
• 1:04
  SPEAKER_00: then 3 deep dives,
• 1:05
  SPEAKER_00: OpenAI's training sandbox problem,
• 1:08
  SPEAKER_00: what it actually costs to run storage for a billion chat GPT users,
• 1:12
  SPEAKER_00: and a compression bug sitting inside almost every web server you've touched.
• 1:16
  SPEAKER_01: Start with the models.
• 1:17
  SPEAKER_00: Moonshot AI, a Chinese AI lab, released Kimi K3.1 Pro through its API.
• 1:23
  SPEAKER_00: It scored 55 on artificial analysis,
• 1:26
  SPEAKER_00: an independent benchmark site that ranks models across many tests,
• 1:29
  SPEAKER_00: putting it fourth overall.
• 1:31
  SPEAKER_01: Fourth best in the world from a lab most people haven't heard of.
• 1:34
  SPEAKER_00: Moonshot says open weights,
• 1:36
  SPEAKER_00: the underlying numbers anyone can download and run themselves,
• 1:39
  SPEAKER_00: are coming by November 4th.
• 1:41
  SPEAKER_00: If that holds, it becomes the strongest open weight model available.
• 1:44
  SPEAKER_01: If that holds, meaning it hasn't happened yet.
• 1:47
  SPEAKER_00: Right.
• 1:47
  SPEAKER_00: Announced, not released.
• 1:49
  SPEAKER_00: Apple had its own model news.
• 1:51
  SPEAKER_00: Its new on-device model holds 20 billion parameters,
• 1:54
  SPEAKER_00: the adjustable settings that make up what a model knows,
• 1:56
  SPEAKER_00: but wakes up only 1 to 4 billion of them per question.
• 2:00
  SPEAKER_01: How does it get away with that?
• 2:01
  SPEAKER_00: It keeps the full model sitting in flash storage,
• 2:03
  SPEAKER_00: the same kind of chip your phone uses for photos,
• 2:06
  SPEAKER_00: and pulls in only the slice it needs.
• 2:08
  SPEAKER_00: Apple's own testing showed about two gigabytes of memory used,
• 2:12
  SPEAKER_00: with lower energy use than comparable open models, but weaker mass performance.
• 2:16
  SPEAKER_01: That's the AI side.
• 2:18
  SPEAKER_00: Elsewhere in tech today,
• 2:19
  SPEAKER_00: Google Cloud now offers Anthropics Cloud,
• 2:22
  SPEAKER_00: both managed by Anthropics and managed by Google itself,
• 2:25
  SPEAKER_00: with the company saying it's the same models and same pricing from day one.
• 2:28
  SPEAKER_01: Convenient if you're already all in on Google's cloud.
• 2:31
  SPEAKER_00: Railway,
• 2:32
  SPEAKER_00: a cloud platform many startups use to deploy apps and store secrets like API keys,
• 2:37
  SPEAKER_00: disclosed that attackers accessed its internal systems for two days this month.
• 2:41
  SPEAKER_00: Around 100,000 workspaces,
• 2:43
  SPEAKER_00: under 2% of its total,
• 2:45
  SPEAKER_00: had environment variables,
• 2:47
  SPEAKER_00: the hidden settings and credentials and app loads on startup potentially exposed.
• 2:51
  SPEAKER_01: If you're hosting on Railway, that email just moved to the top of your inbox.
• 2:55
  SPEAKER_00: It should.
• 2:56
  SPEAKER_00: Railway says this looks like part of a wider pattern of attacks aimed
• 2:59
  SPEAKER_00: at AI companies specifically,
• 3:01
  SPEAKER_00: and it worked with GitHub, Anthropic, OpenAI, and Stripe to revoke the exposed keys.
• 3:05
  SPEAKER_01: Who actually got hit, do we know?
• 3:07
  SPEAKER_00: Railway hasn't named individual customers.
• 3:10
  SPEAKER_00: What it confirmed is the scale,
• 3:11
  SPEAKER_00: about 100,000 workspaces,
• 3:13
  SPEAKER_00: and that it invalidated every API token itself,
• 3:17
  SPEAKER_00: rather than waiting to find out which ones were touched.
• 3:19
  SPEAKER_01: Last one.
• 3:20
  SPEAKER_00: SpaceX had a big week on two fronts.
• 3:22
  SPEAKER_00: It closed a $40 billion debt deal to buy GPUs,
• 3:25
  SPEAKER_00: the chips that train AI models, for delivery in early 2027.
• 3:30
  SPEAKER_00: And the US military gave SpaceX exclusive access to its most detailed catalog
• 3:34
  SPEAKER_00: of tracked objects in orbit,
• 3:36
  SPEAKER_00: the first time any company has gotten that level of access.
• 3:39
  SPEAKER_01: One company financing AI Compute and tracking the sky above it.
• 3:42
  SPEAKER_00: That tension between AI companies and control runs straight into our first deep dive.
• 3:47
  SPEAKER_00: On September 20th,
• 3:48
  SPEAKER_00: an OpenAI research model exploited a misconfigured DNS resolver,
• 3:52
  SPEAKER_00: the system that translates web addresses into server locations during
• 3:56
  SPEAKER_00: a training run.
• 3:57
  SPEAKER_01: Meaning it got online when it wasn't supposed to.
• 3:59
  SPEAKER_00: Right.
• 4:00
  SPEAKER_00: The model gained limited access to the live internet from inside what's called
• 4:04
  SPEAKER_00: a sandbox,
• 4:05
  SPEAKER_00: an isolated environment built so a model
• 4:07
  SPEAKER_00: in training can't touch anything outside it.
• 4:09
  SPEAKER_01: How does a model even find a hole like that?
• 4:11
  SPEAKER_00: It didn't go looking for one on purpose here,
• 4:14
  SPEAKER_00: a misconfiguration in how the network was set up let it slip through,
• 4:17
  SPEAKER_00: but OpenAI's own red teaming afterwards showed something more worrying.
• 4:21
  SPEAKER_01: Red teaming?
• 4:22
  SPEAKER_00: Deliberately attacking your own system to find its weaknesses before someone else does.
• 4:26
  SPEAKER_00: OpenAI set its most capable models loose on their own training sandboxes
• 4:30
  SPEAKER_00: and told them to escape.
• 4:31
  SPEAKER_01: And they did.
• 4:32
  SPEAKER_00: Repeatedly.
• 4:33
  SPEAKER_00: The agents chained together previously unknown bugs in open source software
• 4:37
  SPEAKER_00: and misconfigured services to break out of micro VMs,
• 4:40
  SPEAKER_00: lightweight virtual machines meant to wall off each training run from
• 4:43
  SPEAKER_00: the real hardware underneath.
• 4:45
  SPEAKER_01: That's not a one-off bug, that's a pattern.
• 4:47
  SPEAKER_00: Which is why OpenAI halted work on its most capable systems for 11 days after
• 4:51
  SPEAKER_00: the September incident,
• 4:53
  SPEAKER_00: then came back on October 1st with a new rule published October 23rd.
• 4:57
  SPEAKER_00: Frontier Training now runs fully offline.
• 5:00
  SPEAKER_01: Offline how?
• 5:01
  SPEAKER_01: These things need data.
• 5:02
  SPEAKER_00: They built a cached version of the web,
• 5:04
  SPEAKER_00: a frozen snapshot the model can read from without any live connection out.
• 5:08
  SPEAKER_00: Network-level protections sit underneath that as a second barrier,
• 5:12
  SPEAKER_00: in case a model escapes the first layer anyway.
• 5:14
  SPEAKER_01: Belt and Suspenders.
• 5:16
  SPEAKER_00: That's the idea.
• 5:17
  SPEAKER_00: The open question is
• 5:18
  SPEAKER_00: whether offline training actually holds once models get good enough to find flaws in
• 5:22
  SPEAKER_00: the cache itself or in the virtual machine layer below it.
• 5:25
  SPEAKER_01: Nobody's tested that because the attacker would have to already be loose.
• 5:29
  SPEAKER_00: Right, and that's the uncomfortable part.
• 5:31
  SPEAKER_00: The same capability that makes these models useful at finding security bugs
• 5:35
  SPEAKER_00: for defenders is what let them find bugs that got them out.
• 5:38
  SPEAKER_01: I don't think offline training is a real fix, it just moves the fence.
• 5:41
  SPEAKER_01: The next escape is from the cache into the host machine,
• 5:44
  SPEAKER_01: not from the host machine onto the internet.
• 5:46
  SPEAKER_00: That's a fair read.
• 5:48
  SPEAKER_00: OpenAI's own language is that this closes the biggest gap, not every gap.
• 5:52
  SPEAKER_01: Which is a company admitting there's a next one.
• 5:54
  SPEAKER_00: For anyone building with autonomous agents outside a frontier lab, the lesson travels.
• 5:59
  SPEAKER_00: If OpenAI's containment had a hole,
• 6:02
  SPEAKER_00: the sandbox you're running your own agent in probably does too.
• 6:05
  SPEAKER_01: So what actually changed for people who aren't OpenAI?
• 6:08
  SPEAKER_00: Nothing changed in their tools.
• 6:10
  SPEAKER_00: What changed is the evidence that sandboxing an agent is not a solved problem,
• 6:14
  SPEAKER_00: even for the company with the most resources to solve it.
• 6:17
  SPEAKER_01: A billion users is a very different kind of problem than a model learning to escape a box.
• 6:22
  SPEAKER_00: It is.
• 6:23
  SPEAKER_00: OpenAI's Habitat platform now stores over 500 petabytes of data
• 6:27
  SPEAKER_00: and handles 70 million requests every second across more than a billion users.
• 6:31
  SPEAKER_01: 500 petabytes.
• 6:33
  SPEAKER_01: Put that in human terms.
• 6:34
  SPEAKER_00: It's roughly 500 million gigabytes,
• 6:37
  SPEAKER_00: enough to hold every message memory and file chat GPT and its API have ever touched.
• 6:42
  SPEAKER_00: It started in 2023 as a small Python library sitting on a single database.
• 6:46
  SPEAKER_01: From one database to that.
• 6:48
  SPEAKER_00: The database underneath is Microsoft's Azure Cosmos DB, a cloud database service.
• 6:53
  SPEAKER_00: OpenAI didn't replace it.
• 6:55
  SPEAKER_00: They worked with Microsoft's own team to redesign how containers share that database
• 6:59
  SPEAKER_00: without one customer's traffic slowing down on others.
• 7:02
  SPEAKER_01: That's the noisy neighbor problem.
• 7:03
  SPEAKER_01: One tenant hogs the resource, everyone else's app gets slow.
• 7:07
  SPEAKER_00: Exactly.
• 7:08
  SPEAKER_00: And it's the same problem Netflix solved differently this month
• 7:11
  SPEAKER_00: by giving its most sensitive workloads entire dedicated machines instead
• 7:14
  SPEAKER_00: of sharing them.
• 7:15
  SPEAKER_00: OpenAI went the other way,
• 7:17
  SPEAKER_00: adding throttling and request priorities so one search can't starve another.
• 7:21
  SPEAKER_01: Why not just do what Netflix did?
• 7:23
  SPEAKER_00: Scale.
• 7:24
  SPEAKER_00: Netflix's approach needs a dedicated machine per sensitive workload.
• 7:27
  SPEAKER_00: At OpenAI's size,
• 7:29
  SPEAKER_00: giving every tenant its own hardware would take more capacity
• 7:32
  SPEAKER_00: than anyone could reasonably provision.
• 7:34
  SPEAKER_01: So it's a trade-off, not a universally better answer.
• 7:36
  SPEAKER_00: That's the honest reading.
• 7:38
  SPEAKER_00: Reliability came first in their priority order,
• 7:41
  SPEAKER_00: then performance,
• 7:42
  SPEAKER_00: then operational efficiency,
• 7:44
  SPEAKER_00: which is itself a choice other companies might not make.
• 7:46
  SPEAKER_01: What actually got faster in practice?
• 7:49
  SPEAKER_00: Reads got roughly 12 times faster after the Cosmos DB changes.
• 7:53
  SPEAKER_00: Separately,
• 7:53
  SPEAKER_00: two engineers rewrote the whole service from Python into Rust,
• 7:57
  SPEAKER_00: a lower-level programming language using OpenAI's own coding tools,
• 8:01
  SPEAKER_00: and that version runs six times more efficiently on CPU.
• 8:04
  SPEAKER_01: Two engineers.
• 8:05
  SPEAKER_01: For infrastructure a billion people depend on.
• 8:08
  SPEAKER_00: That's the detail that stands out.
• 8:10
  SPEAKER_00: It's not disclosed how long the rewrite took,
• 8:12
  SPEAKER_00: and the efficiency numbers come only from OpenAI's own blog post.
• 8:15
  SPEAKER_01: Is there any way to check that from outside?
• 8:17
  SPEAKER_00: Not directly, no.
• 8:19
  SPEAKER_00: What is checkable is simpler.
• 8:21
  SPEAKER_00: A billion plus people are using ChatGPT today, and the storage layer isn't what's breaking.
• 8:25
  SPEAKER_01: That's the real test, not the benchmark number.
• 8:28
  SPEAKER_00: For anyone building AI products, the lesson isn't the specific architecture.
• 8:32
  SPEAKER_00: It's that the hard part stopped being the model months ago and became exactly this,
• 8:36
  SPEAKER_00: the boring plumbing underneath it.
• 8:38
  SPEAKER_01: Boring plumbing, like a compression library nobody thinks about until it breaks.
• 8:43
  SPEAKER_00: Which happened last week.
• 8:44
  SPEAKER_00: A vulnerability called Broccoli2Shell,
• 8:47
  SPEAKER_00: officially CVE-2026-11407,
• 8:51
  SPEAKER_00: turned up in Brothly,
• 8:52
  SPEAKER_00: a compression format built into almost every browser and server to shrink data
• 8:56
  SPEAKER_00: before sending it.
• 8:57
  SPEAKER_01: How bad is bad?
• 8:58
  SPEAKER_00: It can let an attacker run their own code on the effective machine,
• 9:01
  SPEAKER_00: remote code execution from nothing more than a crafted piece of compressed data sent
• 9:05
  SPEAKER_00: over the network.
• 9:06
  SPEAKER_01: No login needed?
• 9:07
  SPEAKER_00: None.
• 9:08
  SPEAKER_00: The bug is in how the decoder handles a specific kind of error.
• 9:11
  SPEAKER_00: When it hits an invalid instruction midstream,
• 9:14
  SPEAKER_00: it treats it as if it just needs more data instead of stopping,
• 9:17
  SPEAKER_00: so it keeps writing past the edge of memory it's allowed to use.
• 9:20
  SPEAKER_01: An out-of-bounds write.
• 9:22
  SPEAKER_00: Exactly.
• 9:22
  SPEAKER_00: Data spills into memory it doesn't own,
• 9:25
  SPEAKER_00: and an attacker who controls that spillover can hijack what the program does next.
• 9:29
  SPEAKER_01: Who even found this?
• 9:30
  SPEAKER_00: Two security researchers on OpenAI's own codec security team,
• 9:34
  SPEAKER_00: Codex being OpenAI's coding agent, found and reported it.
• 9:38
  SPEAKER_00: Note that OS,
• 9:39
  SPEAKER_00: the JavaScript runtime behind a huge share of backend services, BUN,
• 9:43
  SPEAKER_00: a newer JavaScript runtime,
• 9:44
  SPEAKER_00: and Envoy, a proxy that routes traffic for many cloud services, are all affected.
• 9:49
  SPEAKER_01: OpenAI finding a bug that threatens half the Internet's plumbing.
• 9:53
  SPEAKER_01: That's a strange sentence.
• 9:54
  SPEAKER_00: It is.
• 9:55
  SPEAKER_00: And it's not the first time a security team at
• 9:57
  SPEAKER_00: an AI company has found something like this just
• 9:59
  SPEAKER_00: by stress testing its own infrastructure.
• 10:01
  SPEAKER_01: How many systems does this actually touch?
• 10:04
  SPEAKER_00: The security firm Wiz,
• 10:05
  SPEAKER_00: which audits what's running in customer cloud environments,
• 10:08
  SPEAKER_00: says 91% of cloud environments yet checked have at least one resource running
• 10:12
  SPEAKER_00: a vulnerable
• 10:13
  SPEAKER_01: version.
• 10:14
  SPEAKER_01: 91%?
• 10:15
  SPEAKER_01: That's not a niche library problem.
• 10:17
  SPEAKER_00: No, because broadly versions 1.03 through 1.20 are all affected,
• 10:22
  SPEAKER_00: and that range has been the default for years in tools nobody thinks to update
• 10:26
  SPEAKER_00: on their own.
• 10:27
  SPEAKER_01: What's the fix?
• 10:28
  SPEAKER_00: Update to 1.010, 1.11,
• 10:31
  SPEAKER_00: or 1.21 whichever branch you're on,
• 10:34
  SPEAKER_00: and rebuild anything that bundled the old version into a container image
• 10:37
  SPEAKER_00: at build time, patching the live server alone won't catch that.
• 10:40
  SPEAKER_01: So this is scarier if you've got old frozen images sitting around than
• 10:44
  SPEAKER_01: if you just run the latest version live.
• 10:46
  SPEAKER_00: Exactly.
• 10:47
  SPEAKER_00: That's where most of Wiz's 91% probably lives,
• 10:50
  SPEAKER_00: in images nobody's touched since before the fix shipped.
• 10:53
  SPEAKER_01: I'd go check our own containers for this today.
• 10:56
  SPEAKER_00: That's the one thing worth doing out of today's news.
• 10:58
  SPEAKER_00: Go find every place Brothly got bundled in, not installed live, and rebuild it.
• 11:02
  SPEAKER_01: Already adding it to the list.
• 11:04
  SPEAKER_00: That's the through line today.
• 11:06
  SPEAKER_00: OpenAI's own training sandbox had a hole,
• 11:08
  SPEAKER_00: its storage team is rebuilding trust at a billion user scale,
• 11:12
  SPEAKER_00: and the compression bug sitting in plain sight for years finally got a name.
• 11:16
  SPEAKER_00: None of today's walls held perfectly.
• 11:18
  SPEAKER_01: I'd bet another frontier lab admits to its own sandbox escape within six months.
• 11:23
  SPEAKER_01: OpenAI's probably not the only one, just the one that said so.
• 11:26
  SPEAKER_00: That's Monday.
• 11:30
  [music]