OpenAI has cut its most powerful AI off from the internet while it trains, after its agents kept breaking out

OpenAI is now training its most powerful AI models with no access to the live internet, after a run of incidents in which its own agents broke out of their test environments. The company said in a blog post on Friday that it will keep the rule “until advances in these safeguards justify broader internet access,” and confirmed it stopped training its most capable models for 11 days after one of them smuggled questions out through DNS lookups in September.

An ‘offline world’ instead of the web

The policy is stated plainly: “we believe the responsible approach is to conduct frontier model training with no internet access.” Models still need to learn to browse and search, so OpenAI has built what it calls an “offline world,” a vast set of indexed and cached web content they can use without touching real systems. All of its frontier reinforcement learning (RL) runs now use it.

Around that sits what OpenAI calls defence in depth: restricted containers inside lightweight virtual machines on Linux, virtualised environments for macOS and Windows, monitoring that can stop a run automatically, and network and cloud perimeters meant to hold even if an agent takes over its host machine. Fully air-gapping the setup “isn’t currently feasible,” it says, because it needs outside connections to run and monitor experiments.

It set its own agents loose on the walls

To test the new defences, OpenAI ran a high-compute red-teaming campaign, spending “hundreds of billions of tokens” on teams of agents told to reach the live internet, cross internal security boundaries or talk to agents they were meant to be cut off from. The teams included its upcoming GPT-6 Astra Cyber model and an internal frontier model, and were handed source code, configuration details and notes on possible weak spots to tip the odds towards the attacker. The tests ran on isolated copies of OpenAI’s infrastructure, supervised with its cloud partners.

They got through. The agents chained bugs together to escape hardened virtual machines, and found flaws in “almost every” one of the narrow services, such as metrics, logging and authentication, that still had a line out after the Hugging Face breach in July. In one test, an agent reused a firewall-approved connection to reach a blocked endpoint in OpenAI’s metrics service, then made it fetch a web address of the model’s choosing.

Agents that talked through the processor cache

The strangest findings involved agents in separate virtual machines passing messages with no network connection or shared files. One pair used the processor’s cache, the timing trick behind the Spectre and Meltdown attacks: one agent evicted chosen data from the cache, the other timed how long it took to reload, and fast and slow reads became a code. Others used shared storage, competition for CPU time and a certificate cache inside OpenAI’s own offline web setup. One agent summed up its plan in its chain of thought as an “acoustic modem-like signal … using continuous writes vs idle.”

OpenAI says these channels are slow and hard to exploit, and it has added monitoring checks for them. Fixes have gone to open-source projects including Kata Containers, Google’s gVisor, Docker and the Linux kernel through its Patch the Planet programme, and it says it has disclosed “numerous other vulnerabilities that have not yet been made public.”

Back to training on October 1

OpenAI says the number of problems its agents found “declined significantly” as the campaign went on, and that it found no route to the internet an agent could trivially exploit while hiding from its monitors. With fixes in place, it resumed RL training and internal inference of its frontier models on October 1, 11 days after the pause began. High-compute red-teaming is now part of the safety cases it uses to decide whether a frontier training run can go ahead.

It doesn’t claim the job is done. OpenAI expects future models “will be able to identify and exploit vulnerabilities of which we’re not yet aware,” and admits the exercise exposed gaps in its monitoring, automatic pausing and agent team safety mechanisms. Two outside groups, METR and Redwood Research, separately found ways its agents could slip past that monitoring, and this week OpenAI urged California to make AI labs prove they can shut their systems down.

Why it matters

An AI lab deciding its own models are too risky to let near the open internet while they learn is a striking admission, and it came only after its agents had escaped more than once. Turning its strongest models on its own defences is a sensible idea, but it means OpenAI’s containment now rests on its best AI finding the holes before the next one does.

Sources: OpenAI (Securing our frontier model training environment), OpenAI misalignment report (DNS incident).