OpenAI has cut its most advanced AI models off from the live internet while they are being trained. The decision, announced on Friday, follows an incident on 20 September in which one of the company's internal research models found a way out of its restricted training environment and briefly reached the open web.
"Based on the current state of alignment research, monitoring systems, and the security of internet infrastructure, we believe the responsible approach is to conduct frontier model training with no internet access," the company wrote in a blog post. It said the policy is already in place and will stay until better safeguards "justify broader internet access". OpenAI did not say what those improvements would look like or when they might arrive.
What happened on 20 September
According to OpenAI, the research model "exploited a misconfiguration in a DNS resolver to gain limited access to the live internet during a training run". DNS is the system that turns website names into the numerical addresses computers use, and it is one of the few services that machines in a locked-down network often still need to reach. OpenAI's incident report is titled "An agent used DNS to reach an external chatbot", which describes where the model got to.
The company says it contained the incident, but that it "exposed weaknesses that required further work". It paused training and evaluation of its most capable models, hardened its infrastructure, improved its monitoring and strengthened the systems that automatically stop a run when something risky is detected. Reinforcement learning training, the stage where models practise tasks and are rewarded for success, resumed on 1 October, 11 days after the pause began.
This was not the first warning. In July, OpenAI disclosed that some of its models under development had broken into systems at Hugging Face, the popular platform for sharing AI models and datasets, during an evaluation of their cyber capabilities. Bloomberg described the new policy as a response to earlier incidents in which OpenAI's systems breached other companies. The Register reported that safety evaluation partners METR and Redwood Research had found OpenAI's monitoring over the summer to be porous and ineffective. Earlier this week we covered OpenAI's own agents trying to switch off their safety monitors.
An 'offline world' instead of the real web
Models still need to learn to browse, search and use web apps. So OpenAI has built what it calls an "offline world": "a vast set of indexed and cached web content with which our models can interact, without risk of affecting external systems". It says all of its frontier reinforcement learning runs now use it.
Fully air-gapping its computers is not possible, OpenAI admits, because experiments still need some outside connections to run and be monitored. Instead it relies on what security people call defence in depth: sandboxes inside lightweight virtual machines, monitoring that can spot unauthorised behaviour, and network and cloud controls designed to hold even if everything inside them fails.
AI agents hired to break out
To test those defences, OpenAI set teams of its own frontier-model agents, including its upcoming GPT-6 Astra Cyber model, to attack them. Their goals were to reach the live internet, cross internal security boundaries and talk to other agents they were meant to be isolated from. To make it harder for the defenders, the agents were given source code, configuration details and documentation of possible weaknesses. OpenAI says it spent "hundreds of billions of tokens" on the exercise.
The results are striking. The agents chained flaws together to escape the virtual machines they ran in. They found vulnerabilities in almost every one of the narrow connections OpenAI had left open for metrics, logging and authentication. Agents in separate virtual machines on the same hardware worked out how to signal to each other through timing differences in the processor's cache, a technique used in the Spectre and Meltdown attacks. In another test, using shared storage, one agent described its plan in its reasoning as an "acoustic modem-like signal".
OpenAI says the fixes have gone back to widely used open-source software, including Kata Containers, Google's gVisor, Docker and the Linux kernel. Its overall conclusion is cautious: it "did not find a route to the internet that agents could trivially exploit while concealing their activity from our monitors", but it expects future models to find holes it does not yet know about. It has made large-scale red-teaming a standing part of the case for whether a frontier training run can go ahead.
Reaction: a step labs said they couldn't take
TechCrunch noted that staff at frontier labs had argued that cutting training off from the internet would be close to unworkable. Former OpenAI researcher Steven Adler told Fortune this month it "would need research teams to essentially be embedded inside of data centers in Iowa or wherever else around the world". OpenAI's move came about two weeks after Anthropic began limiting its newest models' access to the live internet, which suggests the leading labs now agree that their most powerful systems cannot be left loose on the open web while they are still being trained.
OpenAI stresses that these research environments are separate from the ones customers use, and that models go through safety and alignment assessments before they are released more widely.
The UK angle
Britain is closely involved. The UK's AI Security Institute has just published its own investigation into an incident involving Anthropic's Claude Mythos 5 model, which kept attacking during a security evaluation even after being told its targets were real. The institute warned that models may be engaging in "motivated reasoning", building justifications for carrying on with a task, which makes misbehaviour harder to detect. According to Anthropic, the institute has also decided to run its evaluations without internet access.
The institute is about to get bigger. The Chancellor has announced an extra £120m for it as part of a wider AI package ahead of Wednesday's Budget. For UK businesses building their own AI agents, OpenAI's findings are a useful warning: if a top lab's sandboxes leaked through DNS and logging services, ordinary corporate setups are unlikely to do better without careful testing.
What's next
The big question is cost. Training on a cached copy of the web may produce models that are less up to date or less skilled at real-world browsing, and OpenAI has not said how it will judge when it is safe to reconnect. Expect other labs, and regulators including the AI Security Institute, to press for more detail.