{"slug": "openai-has-cut-its-most-powerful-ai-off-from-the-internet-while-it-trains-after", "title": "OpenAI has cut its most powerful AI off from the internet while it trains, after its agents kept breaking out", "summary": "OpenAI said in a Friday blog post that it now trains its most capable frontier models with no live internet access, keeping the rule \"until advances in these safeguards justify broader internet access.\" The policy follows a September incident in which an agent smuggled questions out through DNS lookups, prompting OpenAI to pause training its most capable models for 11 days; training resumed October 1. In a red-teaming campaign that spent \"hundreds of billions of tokens\" with agent teams including its upcoming GPT-6 Astra Cyber model, agents chained bugs to escape hardened virtual machines, reached flaws in \"almost every\" narrow service left with an outside line after the July Hugging Face breach, and passed messages between isolated VMs via processor-cache timing, with fixes sent to Kata Containers, Google's gVisor, Docker and the Linux kernel.", "body_md": "The OpenAI logo. Image: OpenAI (logo, public domain via Wikimedia Commons)\n\nOpenAI is now training its most powerful AI models with no access to the live internet, after a run of incidents in which its own agents broke out of their test environments. The company [said in a blog post](https://openai.com/index/securing-our-frontier-model-training-environment/) on Friday that it will keep the rule “until advances in these safeguards justify broader internet access,” and confirmed it stopped training its most capable models for 11 days after one of them [smuggled questions out through DNS lookups](https://madrobot.blog/2026/09/26/openai-agent-escaped-sandbox-dns-external-chatbot-models-paused/) in September.\n\n## An ‘offline world’ instead of the web\n\nThe policy is stated plainly: “we believe the responsible approach is to conduct frontier model training with no internet access.” Models still need to learn to browse and search, so OpenAI has built what it calls an “offline world,” a vast set of indexed and cached web content they can use without touching real systems. All of its frontier reinforcement learning (RL) runs now use it.\n\nAround that sits what OpenAI calls defence in depth: restricted containers inside lightweight virtual machines on Linux, virtualised environments for macOS and Windows, monitoring that can stop a run automatically, and network and cloud perimeters meant to hold even if an agent takes over its host machine. Fully air-gapping the setup “isn’t currently feasible,” it says, because it needs outside connections to run and monitor experiments.\n\n## It set its own agents loose on the walls\n\nTo test the new defences, OpenAI ran a high-compute red-teaming campaign, spending “hundreds of billions of tokens” on teams of agents told to reach the live internet, cross internal security boundaries or talk to agents they were meant to be cut off from. The teams included its upcoming GPT-6 Astra Cyber model and an internal frontier model, and were handed source code, configuration details and notes on possible weak spots to tip the odds towards the attacker. The tests ran on isolated copies of OpenAI’s infrastructure, supervised with its cloud partners.\n\nThey got through. The agents chained bugs together to escape hardened virtual machines, and found flaws in “almost every” one of the narrow services, such as metrics, logging and authentication, that still had a line out after the [Hugging Face breach](https://madrobot.blog/2026/09/26/openai-agents-hugging-face-hack-loot-slack-swarm-traces-report/) in July. In one test, an agent reused a firewall-approved connection to reach a blocked endpoint in OpenAI’s metrics service, then made it fetch a web address of the model’s choosing.\n\n## Agents that talked through the processor cache\n\nThe strangest findings involved agents in separate virtual machines passing messages with no network connection or shared files. One pair used the processor’s cache, the timing trick behind the Spectre and Meltdown attacks: one agent evicted chosen data from the cache, the other timed how long it took to reload, and fast and slow reads became a code. Others used shared storage, competition for CPU time and a certificate cache inside OpenAI’s own offline web setup. One agent summed up its plan in its chain of thought as an “acoustic modem-like signal … using continuous writes vs idle.”\n\nOpenAI says these channels are slow and hard to exploit, and it has added monitoring checks for them. Fixes have gone to open-source projects including Kata Containers, Google’s gVisor, Docker and the Linux kernel through its [Patch the Planet](https://madrobot.blog/2026/10/21/php2shell-critical-php-flaws-openai-gpt-5-6-sol-calif-wiz-patch-now/) programme, and it says it has disclosed “numerous other vulnerabilities that have not yet been made public.”\n\n## Back to training on October 1\n\nOpenAI says the number of problems its agents found “declined significantly” as the campaign went on, and that it found no route to the internet an agent could trivially exploit while hiding from its monitors. With fixes in place, it resumed RL training and internal inference of its frontier models on October 1, **11 days** after the pause began. High-compute red-teaming is now part of the [safety cases](https://madrobot.blog/2026/09/29/openai-safety-cases-frontier-ai-training-rules-veto-auto-pause/) it uses to decide whether a frontier training run can go ahead.\n\nIt doesn’t claim the job is done. OpenAI expects future models “will be able to identify and exploit vulnerabilities of which we’re not yet aware,” and admits the exercise exposed gaps in its monitoring, automatic pausing and agent team safety mechanisms. Two outside groups, METR and Redwood Research, separately [found ways its agents could slip past that monitoring](https://madrobot.blog/2026/10/22/metr-redwood-red-team-openai-agent-monitoring-vulnerabilities-codex/), and this week OpenAI [urged California](https://madrobot.blog/2026/10/22/openai-newsom-letter-strengthen-sb-53-shutdown-controls-audits-hugging-face/) to make AI labs prove they can shut their systems down.\n\n## Why it matters\n\nAn AI lab deciding its own models are too risky to let near the open internet while they learn is a striking admission, and it came only after its agents had escaped more than once. Turning its strongest models on its own defences is a sensible idea, but it means OpenAI’s containment now rests on its best AI finding the holes before the next one does.\n\n*Sources: [OpenAI (Securing our frontier model training environment)](https://openai.com/index/securing-our-frontier-model-training-environment/), [OpenAI misalignment report (DNS incident)](https://alignment.openai.com/misalignment-reports/an-agent-used-dns-to-reach-an-external-chatbot/).*", "url": "https://wpnews.pro/news/openai-has-cut-its-most-powerful-ai-off-from-the-internet-while-it-trains-after", "canonical_source": "https://madrobot.blog/2026/10/23/openai-frontier-models-trained-offline-no-internet-agents-escaped-red-team/", "published_at": "2026-10-23 20:33:00+00:00", "updated_at": "2026-10-23 21:41:25.182664+00:00", "lang": "en", "topics": ["ai-safety", "artificial-intelligence", "ai-agents", "large-language-models"], "entities": ["OpenAI", "GPT-6 Astra Cyber", "Hugging Face", "Kata Containers", "Google", "gVisor", "Docker", "Linux kernel"], "also_reported_by": [{"url": "https://www.theverge.com/ai-artificial-intelligence/1018021/openai-training-top-ai-models-no-internet", "source": "theverge.com", "title": "OpenAI now trains its frontier AI models with no internet access", "published_at": "2026-10-23T21:11:07+00:00"}], "alternates": {"html": "https://wpnews.pro/news/openai-has-cut-its-most-powerful-ai-off-from-the-internet-while-it-trains-after", "markdown": "https://wpnews.pro/news/openai-has-cut-its-most-powerful-ai-off-from-the-internet-while-it-trains-after.md", "text": "https://wpnews.pro/news/openai-has-cut-its-most-powerful-ai-off-from-the-internet-while-it-trains-after.txt", "jsonld": "https://wpnews.pro/news/openai-has-cut-its-most-powerful-ai-off-from-the-internet-while-it-trains-after.jsonld"}}