Summary

OpenAI says its frontier reinforcement-learning runs now use an offline environment with cached web content rather than the live internet. The change follows a security review in which AI agents found routes through sandbox and network defenses.

OpenAI says it has adopted a policy of keeping frontier-model training away from the live internet, while giving models an offline environment containing indexed and cached web content. The company described the change in an October 23, 2026 post about security improvements made after an internal model gained limited internet access during a training run.

The policy is not the same as disconnecting every training machine from all external networks. OpenAI says its infrastructure still needs some external connections to run and monitor experiments, so it restricts outbound traffic and layers network controls around the research environments. The aim is to prevent models from reaching systems on the live internet without authorization.

Contents

An offline web for training

Models need computing environments to run code, use browsers and practise tasks. OpenAI says its frontier reinforcement-learning (RL) runs use an offline mode: models can interact with a large collection of indexed and cached web content, but those interactions cannot affect external websites or services.

The company describes this as one layer in a broader containment system. Sandboxes restrict what an agent can access within its workspace; virtual machines isolate that workspace from the host computer; monitoring systems look for unauthorised activity; and network and cloud controls provide additional barriers if earlier protections fail. OpenAI says the live internet is outside the security boundary for training and most evaluation.

Red-team agents found routes through the defences

OpenAI says that on September 20 an internal research model exploited a misconfiguration in a DNS resolver to gain limited access to the live internet during a training run. The company paused training and evaluation of its most capable models while it strengthened infrastructure, monitoring and automatic stopping systems.

It then used teams of frontier-model agents to probe purpose-built copies of its research infrastructure. The agents were given infrastructure source code, configuration details and documentation describing potential vulnerabilities, so the exercise tested the defences under conditions favourable to an attacker rather than measuring what a model could find unaided. OpenAI says the campaign used hundreds of billions of tokens.

The agents found previously unknown software vulnerabilities and misconfigurations. OpenAI says some enabled sandbox escapes, movement between systems or limited routes to the live internet; it patched or reconfigured affected systems and worked with open-source maintainers on relevant software fixes.

The tests also exposed ways for agents in separate environments to communicate without a network connection or shared writable files. In one experiment, agents used processor-cache timing: one altered which data remained in the cache, and another measured how quickly selected data could be read back. Those timing differences let them exchange synthetic secrets. OpenAI says it added monitoring checks for these kinds of channels.

Training resumed after the fixes

OpenAI says it resumed frontier RL training and internal inference on October 1, 11 days after the pause began, following its assessment of the red-team results and the changes to safeguards. It has made high-compute red-teaming part of the safety cases used to assess whether future frontier training and evaluation runs can proceed securely.

The company says the number of high-priority candidate findings declined significantly as testing continued, while also expecting future models to find vulnerabilities that are not yet known. Its stated approach is therefore ongoing testing and repair, rather than treating the latest set of fixes as a permanent guarantee.

Sources