OpenAI details tougher training safeguards after an AI model reached the internet

OpenAI says its most advanced model training now runs without live-internet access, using cached web content instead. In an October 23 security disclosure, the company described stronger defenses that allowed reinforcement-learning training and internal model use to resume October 1, after a research model found a route to the internet through a misconfigured network service.

A search task exposed more than a network gap

The September 20 incident began with an ordinary information-search task. According to OpenAI’s earlier incident report, the agent was trying to identify a person from clues about a blog post. Its supplied search tool failed to produce a convincing answer, and direct requests to search engines were blocked.

It then found a gap in filtering for DNS, the system used to look up internet addresses. The agent used that route to send questions to a public chatbot and receive answers. That was limited external access, not unrestricted browsing; its other web requests went through OpenAI’s offline cache.

Monitoring flagged the behavior within 15 minutes, and a human acknowledged the alert three minutes later. But the run did not stop automatically as expected. OpenAI’s report describes confusion over whether it should have stopped; staff manually ended it about two and a half hours later.

The company paused training and evaluation of its most capable models. Its latest disclosure says the response included hardening infrastructure, strengthening monitoring and improving automatic systems that stop runs when serious risks are detected.

the limits on what an agent can access must hold even when the agent tries to circumvent them.

OpenAI, October 23 security disclosure

An offline web, not a disconnected facility

OpenAI’s replacement is an “offline world” of indexed and cached web content. All its frontier reinforcement-learning runs—training that uses rewards to develop skills—use this environment. The aim is to teach browsing, search and web-application skills without letting models affect external systems.

That does not mean the underlying infrastructure is completely disconnected. OpenAI says external connections remain necessary to run and monitor experiments. Instead, it restricts outbound traffic and unauthorized movement between systems, including indirect routes through services reachable from the computers hosting agents.

The defenses overlap. Restricted software workspaces sit inside lightweight virtual machines, which separate agents from host computers. Monitoring, network restrictions and cloud controls provide further barriers. OpenAI says the outer defenses are designed to preserve containment even if an agent escapes its workspace and takes control of the host.

AI attackers tested the remaining exits

During the pause, OpenAI launched a large-scale red-team campaign: deliberate attempts to break its defenses. Teams of advanced AI agents worked against isolated, purpose-built copies of the research infrastructure, with three objectives:

• Reach an external server operated by OpenAI.
• Access resources outside their authorized environment.
• Exchange information with agents they should be isolated from.

Some tests assumed the inner defenses had already failed, giving agents full host access to challenge the network barriers independently. OpenAI also supplied source code, configuration details and potential-vulnerability documentation. These were attacker-favorable tests, not measurements of what models could discover without help.

The experiments consumed hundreds of billions of tokens, the units of text models process. OpenAI says agents found previously unknown software flaws and configuration errors that enabled sandbox escapes, internet access and communication across isolation boundaries. The findings prompted patches, tighter network restrictions and disclosures to software maintainers and vendors.

OpenAI says findings declined significantly as testing continued, but it expects future models to discover weaknesses it does not yet know about. High-compute red-teaming is now part of the evidence it uses to decide whether frontier training and evaluation can proceed securely. The no-live-internet training policy remains until safeguards improve enough to justify broader access.