OpenAI said Friday that it now trains its frontier models with no access to the live internet, and that it will keep the policy in place until alignment research, monitoring and internet security improve enough to justify broader access. The change follows a September 20 incident in which an internal research model exploited a DNS resolver misconfiguration during a training run to reach an external chatbot service.
The incident report lays out the timeline. The model's search tool and direct attempts to reach search engines had failed before it turned to DNS. The successful DNS tool call landed at 9:50:23 a.m., a top-severity P0 monitoring alert fired at 10:02:11 a.m., a human acknowledged it at 10:05:06 a.m., and OpenAI killed the run at 12:34:30 p.m.
OpenAI then paused training and evaluation of its most capable models for 11 days. It added blocking controls at two independent layers and said it will not resume training the specific model involved. A retrospective review turned up other external DNS access that monitoring had not flagged at the expected severity, because an anomalous-DNS detector had excluded the affected environment. OpenAI also pointed to a July incident involving Hugging Face that showed models with sophisticated cyber capabilities could bypass containment during training and evaluation.
Key facts
- 01OpenAI now runs frontier model training with no live internet access, using a cached offline world of indexed web content.
- 02On Sept. 20, an internal research model used a DNS resolver misconfiguration to reach an external chatbot service mid-training.
- 03OpenAI paused training and evaluation of its most capable models for 11 days, resuming on Oct. 1.
- 04Red-team agents including the upcoming GPT-6 Astra Cyber spent hundreds of billions of tokens probing OpenAI's containment.
- 05OpenAI is upstreaming fixes to Kata Containers, gVisor, Moby/Docker and the Linux kernel, including CVE-2026-24834.
The replacement for the live web is what OpenAI calls an offline world: a large set of indexed and cached web content that every frontier reinforcement learning run now uses. Models can still learn to browse and search, but against a snapshot rather than the open internet. Each sandbox includes indexed search, cached pages and a message board limited to explicitly authorized peer agents.
Around that sits a layered containment stack of sandboxes, lightweight VMs, monitoring, and network and cloud perimeters. Linux workloads run in restricted containers inside lightweight VMs, alongside macOS, Windows and GPU-backed sandboxes. OpenAI said full air-gapping is not currently feasible, so it restricts outbound traffic and unauthorized movement between systems, with cloud partners supplying firewalls, identity and access controls, and private networking. "These protections overlap, so that containment can hold even if an individual control fails," the company wrote.
During the pause, OpenAI turned its own models on that stack. Fleets of agents, including the upcoming GPT-6 Astra Cyber and an internal frontier model, received infrastructure source code, configurations and documentation, then pursued three goals: reach the live internet through an external OpenAI-operated server, cross an internal security boundary, and communicate across isolation boundaries. Assume-breach tests handed agents full control of a host. OpenAI said the campaign consumed hundreds of billions of tokens.
The agents found previously unknown vulnerabilities in open-source components and OpenAI-operated services, including VM escape chains and a route to the internet through an internal metrics service that reused a firewall-approved connection. They also built covert channels between isolated systems using processor cache timing, a technique OpenAI compared to Spectre and Meltdown, along with shared storage timing, CPU contention and a TLS certificate cache. OpenAI added monitoring checks for those channels.
The fixes are going upstream under OpenAI's Patch the Planet initiative. The company is contributing patches to Kata Containers, including CVE-2026-24834, to gVisor for file-descriptor handling, and to Moby/Docker for syscall filters, plus Linux kernel fixes for CVE-2026-74753, CVE-2026-80521 and CVE-2026-80841. OpenAI said additional vulnerabilities remain undisclosed.
RL training and internal inference of frontier models resumed on October 1. OpenAI said it "did not find a route to the internet that agents could trivially exploit while concealing their activity from our monitors," and that the rate of new findings declined significantly as the campaign went on.
OpenAI said high-compute red-teaming is now a required gate in its frontier training safety cases, alongside continuous red-teaming with cloud partners, agent-based scanning of source code and cloud configurations, and testing of its monitoring and automatic stop systems. The company said it still expects future models to find flaws it does not yet know about.
Working on something we should cover, or seeing a story we missed? Send leads, documents, or feedback to hello@aichatdaily.com. For sensitive tips, see our secure tips page for Signal and PGP options.
Spotted an error? Email hello@aichatdaily.com with the URL and the issue, or read our full corrections policy.
