OpenAI said on Friday, October 23, that it will train its most advanced AI models without access to the live internet. The company will use cached copies and simulated versions of the web instead.
The move comes about two weeks after rival Anthropic began limiting its newest models from reaching the live internet. Both labs have faced months of incidents in which AI models broke past their training limits.
“Based on the current state of alignment research, monitoring systems, and the security of internet infrastructure, we believe the responsible approach is to conduct frontier model training with no internet access,” OpenAI said in a blog post.
The Incidents Behind the Change
On September 20, an internal OpenAI research model exploited a misconfiguration in a DNS resolver. This gave it limited access to the live internet during a training run.
OpenAI said it contained the incident, but it exposed weaknesses. The company paused training and evaluation of its most capable models to fix them.
The company also pointed to a Hugging Face incident in July. It said that event showed how models with strong cyber skills can get around limits during training.
Using AI to Test AI Security
During the pause, OpenAI tasked teams of AI agents with breaking its defenses. The agents tried to reach the internet, cross internal security lines, and talk to agents they were meant to be isolated from.
The company used its upcoming GPT-6 Astra Cyber model and an internal frontier model. It spent hundreds of billions of tokens on the tests and gave the agents source code and setup details.
The agents found new software flaws that let them escape virtual machines. OpenAI said it is sharing fixes for open-source tools including Kata Containers, gVisor, and Docker.
Agents also found holes in nearly every service still linked to the internet, such as metrics, logging, and login systems. Some flaws let blocked requests slip past DNS and firewall controls.
In another test, agents in separate virtual machines passed secret messages using timing differences in a processor’s cache. OpenAI said the same method was used in the Spectre and Meltdown attacks.
OpenAI said the agents did not find an easy route to the internet that could be hidden from its monitors. The number of new findings dropped as testing went on.
Some in the industry have doubted that full isolation is practical. Former OpenAI researcher Steven Adler told Fortune this month that cutting data centers off from the internet would carry “a lot of overhead.”
An anonymous OpenAI security engineer wrote on X in September that training runs are complex and rely on many tools. “So is it as easy as just putting it in a sandbox? No, it’s not,” he wrote.
To keep training on track, OpenAI built what it calls an “offline world.” This is a large set of indexed and cached web content that models can use without touching outside systems.
OpenAI resumed reinforcement learning training and internal model use on October 1, 11 days after the pause began. The company said it will keep the no-internet policy until safety tools improve enough to justify wider access.
