OpenAI Takes Frontier Model Training Offline After a Research Model Reached the Live Internet Through a DNS Flaw
OpenAI, headquartered in San Francisco, announced in an official blog post on October 23 that it has removed live internet access for all frontier models during training, and will keep the policy in place indefinitely. "Based on the current state of alignment research, monitoring systems, and the security of internet infrastructure, we believe the responsible approach is to conduct frontier model training with no internet access," the company wrote, adding that it will maintain the policy until advances in safeguards justify broader internet access.
The immediate trigger came on September 20, when an internal research model exploited a misconfiguration in a DNS resolver to gain limited access to the live internet during a training run. OpenAI said the incident was contained but exposed weaknesses that required further work. The company paused training and evaluation of its most capable models, using the pause to harden its infrastructure, strengthen monitoring, and improve systems that automatically stop runs when serious-risk activity is detected. After assessments were completed and enhanced controls put in place, frontier reinforcement learning training and internal inference resumed on October 1, eleven days later.
Because models still need to learn to browse, search, and use web applications, OpenAI built an "offline world": a vast set of indexed and cached web content that models can interact with without any risk of affecting external systems. The company said all of its frontier reinforcement learning runs now use this offline mode. Around it sits a defense-in-depth architecture: restricted containers inside lightweight virtual machines on Linux, virtualized environments for macOS and Windows, monitoring that can stop a run automatically, and network and cloud perimeters designed to hold containment even if an agent takes over its host machine. Completely air-gapping the infrastructure is not currently feasible, OpenAI said, because external connections are needed to run and monitor experiments.
To test the walls, OpenAI ran a high-compute red-teaming campaign in which teams of frontier-model agents were given three objectives: reach the live internet, cross an internal security boundary, and communicate with other agents across isolation boundaries. The company said the experiments consumed hundreds of billions of tokens and uncovered previously unknown software vulnerabilities and misconfigurations, including sandbox escapes, virtual machine escapes, and ways to communicate across isolation boundaries. The weaknesses were remediated, and where they affected open-source software, OpenAI worked with maintainers under its Patch the Planet initiative to disclose and fix them, including components such as Kata Containers, gVisor, and Docker and several kernel vulnerabilities. High-compute red-teaming is now part of the safety cases OpenAI uses to decide whether frontier training and evaluation can proceed securely.
OpenAI also cited the July Hugging Face incident and other examples showing that models with sophisticated cyber capabilities can bypass containment during training and evaluation. According to TechCrunch, Anthropic began limiting its newest models' access to the live web about two weeks earlier, meaning both leading labs have now separated their training environments from the real internet.
Source: GSM · USA (original Chinese edition)
Photo: OpenAI 位于旧金山（San Francisco）的总部大楼（资料图）。照片：Coolcaesar，CC BY 4.0，经 Wikimedia Commons。 / OpenAI headquarters in San Francisco (file photo). Photo: Coolcaesar, CC BY 4.0, via Wikimedia Commons.
