CVE-2026-65616: Study Locally Reconstructs Agent Privilege Escalation During OpenAI ExploitGym Assessments

By recreating the misconfigured servers into isolated containers, the study shows that the flaw exploited by the agents already existed in the training example, and that Zero Trust principles would have neutralized it.

In mid-2026, crash reports that occurred during autonomous agent evaluations claimed that state-of-the-art models had escaped from their test environment, coordinating and attacking cloud infrastructure. A preprint by Alicia Colmenero-Fernández offers a forensic analysis of these claims on arXiv, focusing on OpenAI's ExploitGym evaluations and the first phase of privilege escalation, which targeted internal packet repositories.

A flaw already present in the training example

The study rebuilt the configuration of the training example provided by OpenAI in isolated servers, as well as the cryptographic verification bypass listed under the identifier CVE-2026-65616. Misconfigured systems made it possible to forge tokens and elevate privileges with simple HTTP requests, Python and JavaScript, without sophisticated techniques. Focus: The conditions of the training example and the configuration errors exploited in phase one and subsequent phases fall under the same patterns.

According to this analysis, these incidents are not so much a sign of a worrisome emerging capability as a learning and deployment environment that is not sufficiently siloed. It also shows how a Zero Trust architecture, which never assumes trust in an internal component, would have neutralized this common attack vector.