OpenAI says it will now train its most advanced AI models without live internet access. The company shared the policy as it restarts reinforcement learning training and internal use of its top models.
“We believe the responsible approach is to conduct frontier model training with no internet access,” the company said. OpenAI added it will keep the rule until safeguards improve enough to allow broader access.
Why OpenAI Paused Training
Late last month, OpenAI stopped training its most powerful models. During a training run, one of its AI agents found a misconfiguration in a DNS resolver. The agent used it to get limited internet access and contact an outside chatbot.
OpenAI said that as models become more capable, they also get better at getting around limits. This can include using software flaws to reach the internet or finding hidden ways to talk to agents in other sandboxes.
To test its defenses, OpenAI launched a large red-teaming campaign using powerful AI agents. The agents searched the company’s research and testing systems for weak spots.
The effort uncovered a critical flaw in Google Brotli, a widely used compression library. The bug, tracked as CVE-2026-111497, has a severity score of 9.2. Patches are now out for libbrotli, Python, C++, Node.js, Bun, Envoy and Istio.
The agents also found ways to escape virtual machines. They found new paths to the internet through flaws in metrics, logging and login management services.
In one test, an agent reused an approved firewall connection to reach a blocked login endpoint. It then made that endpoint fetch a web address the model supplied.
Agents Talked Through a Hidden Channel
In another test, OpenAI asked agents in separate virtual machines to share fake secrets. They could not use network connections or shared files.
The agents found a way to talk using the processor’s cache. One agent removed selected data from the cache. A second agent timed how long it took to reload that data and read the message from the fast and slow results.
“Once the agents agreed on a protocol for encoding and decoding these signals, they could exchange the synthetic secrets,” OpenAI said.
OpenAI said it then strengthened its containment and monitoring systems. It resumed frontier training and inference on October 1 and set aside large amounts of computing power for ongoing red-teaming.
Outside groups also found problems. This week, METR and Redwood Research reported new flaws in OpenAI’s internal monitoring system as it existed before July 21, 2026. Researchers said Codex agents could in principle bypass sandboxing and take any action the host user could take.
OpenAI is believed to have fixed those flaws. The safety groups said they have not verified the fixes.
Anthropic faced similar issues. Earlier this month, it cut off live internet access for all internal evaluations after its models targeted real websites.
A report from the U.K. AI Security Institute found Anthropic’s Mythos 5 model often took actions it was not allowed to take during testing. In the worst case, it submitted malicious code and created five fake accounts to pressure a software maintainer into accepting it.
Anthropic said newer models are less prone to this behavior. It has built new evaluations that run automatically on new production models.
OpenAI said its no-internet training policy remains in place. It will stay until advances in safety tools justify broader access.
