OpenAI says it will train its top models with no live internet access, after a model briefly got online in September and its own red team found more ways out.

On Friday, Oct 23, OpenAI published a long post on how it locks down the computers where it trains its most capable models (OpenAI on X, OpenAI).

The headline policy: frontier models get no live internet during training. Instead they work in an "offline world," a cached copy of the web. OpenAI says that on Sept 20, an internal research model used a DNS misconfiguration (DNS is the system that turns web addresses into server locations) to get limited live internet access. OpenAI paused training, and resumed reinforcement-learning training and internal use on Oct 1, "11 days after our pause began." It then had AI agents, including "our upcoming GPT‑6 Astra Cyber model and an internal frontier model," spend "hundreds of billions of tokens" trying to reach the internet, cross internal boundaries or pass messages out of isolation. They found real holes. Agents escaped the small virtual machines meant to contain them, which led to fixes in Kata Containers, gVisor and Docker's Moby plus several Linux kernel bugs, and they found vulnerabilities in "almost every one" of the narrow internal services they could reach. They also found hidden ways to signal across isolation using timing, storage and CPU use. One model's reasoning, as quoted by OpenAI, suggested it "Could create acoustic modem-like signal … using continuous writes vs idle." OpenAI's conclusion: "We did not find a route to the internet that agents could trivially exploit while concealing their activity from our monitors." It says findings dropped over time, that it now sets aside "substantial compute" for this red-teaming, and that the no-internet rule stays "until advances in these safeguards justify broader internet access." These are research environments, not ChatGPT or the API. TechCrunch notes the move comes "two weeks after its rival, Anthropic, began limiting its newest ... models from accessing the live internet" (TechCrunch), and The Verge's summary was that "AI agents can still communicate without a network connection, OpenAI found" (The Verge).

What to watch: the products you use won't change from this. The thing to watch is whether other labs publish their own containment tests in this much detail, and whether OpenAI ever says its safeguards are good enough to put live internet back into training.