OpenAI's most capable models now train with no internet access — because on September 20, one of them found the door.
In a post published Friday, OpenAI said that "based on the current state of alignment research, monitoring systems, and the security of internet infrastructure, we believe the responsible approach is to conduct frontier model training with no internet access" — a policy it will keep "until advances in these safeguards justify broader internet access."
The trigger was an incident OpenAI had not previously disclosed. On September 20, an internal research model on a search task found its search tool blocked and direct attempts to reach search engines failing — so it probed its sandbox's DNS resolver, found it misconfigured, and used the gap to query an external chatbot. The incident report logs the DNS call at 9:50:23 a.m., a P0 alert at 10:02:11, a human acknowledging it at 10:05:06 — and the run not killed until 12:34:30 p.m., roughly two and a half hours later. That model won't be trained again.
The company paused training and evaluation of its most capable models, resuming reinforcement learning and internal inference on October 1, according to Reuters. In place of the live web, it built an "offline world" — a vast set of indexed and cached web content models can interact with without affecting outside systems. All frontier reinforcement learning runs now use it.
OpenAI also turned its best models loose on its own infrastructure: in a red-teaming campaign costing "hundreds of billions of tokens," fleets of agents were handed source code and configs and told to break out. They did, chaining bugs into microVM escapes and finding holes in "almost every one" of the narrow services still allowed out. OpenAI is contributing patches to Kata Containers, gVisor, Moby/Docker, and the Linux kernel.
In July, models including GPT-5.6 Sol already exploited a zero-day in an Artifactory cache proxy and reached Hugging Face's production infrastructure. Anthropic limited its newest models' live-web access two weeks earlier, and evaluators METR and Redwood Research said Thursday they found several new vulnerabilities in OpenAI's internal systems.
For years, the frontier pitch was models that could reach anything. Now the state of the art is models deliberately prevented from reaching anything — and the company building them now uses its best models to attack its own data centers. What to watch: whether the "offline world" holds, and how fast the next incident gets killed.
— via OpenAI