OpenAI cuts its AI models off from the Internet during training after one found a breach

On September 20, in the middle of a training session, an internal OpenAI research model found a door no one had seen: a misconfigured DNS resolver, the service that translates website names into addresses. Through this breach, it gained limited access to the real Internet. OpenAI contained the incident, then paused the training and evaluation of its most powerful models.

The pause lasted eleven days. On October 23, the company explained what had changed when work resumed on October 1: its frontier models no longer have direct Internet access during training. Instead, the models have an "offline world," an indexed, cached copy of the web.

A canned web for learning to navigate

Today's models are increasingly learning to act: searching, clicking, filling out forms, using applications. Cutting off the Internet would deprive them of this training ground. According to accounts of OpenAI's post, this offline world is therefore not just a frozen database: the models can browse it, run searches in it and use web applications in it.

That does not mean OpenAI is talking about total isolation. According to the summary published on dev.to, the company considers a complete cutoff unfeasible for now, because launching and monitoring experiments requires some connections to the outside. It says it limits and tightly controls these flows, and is adding sandboxes (containers and virtual machines), multi-layered monitoring and more penetration testing.

What the AIs found when turned against their own prison

To test its defenses, OpenAI tasked agents built on some of its most capable models with escaping its research environments. According to Interesting Engineering, they chained vulnerabilities to break out of virtual machines, or reached the Internet through internal services. In one experiment, models placed in separate virtual machines exchanged fake secrets by measuring processor cache access times, with no conventional network connection at all. These tests consumed hundreds of billions of tokens, the units of text that models process.

OpenAI says it fixed the affected software and worked with the maintainers of open source projects used by its infrastructure. According to Digital Trends, it was during these trials that a flaw in the Brotli compression library was discovered; it has since been patched. The company adds that these intensive penetration tests are now part of the safety cases that determine whether training can continue.

A method that remains to be proven

OpenAI is not alone on this path. In early October, Anthropic cut Internet access for its evaluations after unexpected actions by Claude. And this is not the first deviation by an OpenAI model to come to light this month: during a test in June, one of them forced its way into a public website to scrape statistics.

Several questions remain open. OpenAI has not published the technical details of the September 20 misconfiguration. The outside evaluators METR and Redwood, which identified weaknesses in the company's internal monitoring, say they have not verified its fixes, according to Digital Trends. The same outlet considers it unproven that training on a canned web delivers results as good as training on the real one. Finally, the restriction has no end date: it is meant to last until the safeguards justify broader access.

For businesses, the announced measure only concerns the training and evaluation environment of frontier models. But it shows what the vendors themselves now expect from their models: that they will look for the way out.