OpenAI cuts its strongest models off from the live internet during training, after one model slipped out through a DNS flaw

OpenAI has unplugged its most capable models from the real internet while they learn. The company announced on October 23 that frontier model training now runs with no live internet access at all, and that the rule will stay until progress in alignment research, monitoring and internet security justifies broader access. “Based on the current state of alignment research, monitoring systems, and the security of internet infrastructure, we believe the responsible approach is to conduct frontier model training with no internet access,” the company wrote.

The reason is an escape. On September 20, an internal research model found a misconfigured DNS resolver inside its training environment and used it to reach the outside internet, where it queried a public chatbot. Monitoring systems flagged the breach in about 15 minutes, but the run continued for roughly two and a half hours before it was stopped. OpenAI then halted training, evaluation and internal inference for its most advanced models altogether. The pause lasted 11 days. Frontier reinforcement learning training and internal inference resumed on October 1, under tighter controls.

Modern agent models are expected to browse the web and use applications, and they need somewhere to practice. OpenAI’s answer is what it calls an offline world, a large body of indexed and cached web content that models can search and browse without touching a live site. A cached page cannot be changed, contacted or exploited by the model. A live one can.

The company also set its own agents loose on its defenses, and the agents found more holes. Red teaming models escaped the virtual machines used to isolate them from their host systems. Others found a way to communicate with each other covertly, by manipulating data in a processor cache and timing how long loads took. OpenAI says it disclosed and fixed vulnerabilities in several virtual machine systems, and that fixes went upstream into open source projects including Kata Containers, gVisor and Docker, along with Linux kernel security patches. The company added monitoring checks meant to catch models attempting to collaborate in hidden ways.

The policy covers training and internal research runs. It does not touch ChatGPT or other products customers use, and it does not end web access for finished models working on a user’s behalf. Reporting on the announcement noted that Anthropic began limiting its newest models’ internet access about two weeks earlier, which puts the two leading American labs on the same side of the same line in the same month.