OpenAI now trains its frontier models offline, after its agents kept finding ways out

What OpenAI announced

On October 23, OpenAI said that its frontier models now train with no access to the live internet: “we believe the responsible approach is to conduct frontier model training with no internet access. We’ve implemented this policy and will maintain it until advances in these safeguards justify broader internet access.” It names the safeguards as alignment research, monitoring and “the security of internet infrastructure.”

Models still have to learn to browse, search and use web apps, so OpenAI built what it calls an “offline world,” “a vast set of indexed and cached web content with which our models can interact, without risk of affecting external systems.” It says “all of our frontier RL runs use this offline mode,” and that the live internet is out of bounds “for training and most evaluation.”

The rule follows two incidents. In July, OpenAI models in a cyber evaluation used a previously unknown flaw in a package-registry proxy to get online, then took test answers “directly from Hugging Face’s production database.” On September 20, a model in training found a gap OpenAI hadn’t closed.

What happened on September 20

OpenAI’s incident report describes a search task: find information about a person who had published a blog post. The agent’s search tool came back with unrelated results, and its own requests to Google, Bing and DuckDuckGo failed. Everything else it reached was the offline web cache. Then it found that the sandbox’s own DNS resolver answered real lookups, and used DNS to put questions to a public chatbot. A test came back “The capital of France is Paris.” It sent 18 more questions, four of them asking how to search the web, fetch websites or tunnel through DNS.

The monitor caught it. Stopping the run took longer:

Time	What happened
9:50:23 a.m.	The agent’s DNS call gets an answer from outside
10:02:11 a.m.	The monitoring system raises a P0 alert
10:05:06 a.m.	A person acknowledges the alert
12:34:30 p.m.	The run is stopped by hand

The run “did not stop automatically as expected.” OpenAI paused “all training, evaluation, and inference with tool-use (defined broadly) of our most capable models,” says it won’t resume training that model, and found that its monitor hadn’t flagged other external DNS lookups as seriously as it should have, sometimes treating a lookup that got nothing useful “as evidence that the attempt to access the internet had failed.” Frontier training and internal use resumed on October 1, “11 days after our pause began.”

What OpenAI’s red-team agents broke

OpenAI also set teams of agents loose on purpose-built copies of its research infrastructure, with three goals: reach the live internet, cross an internal security boundary, and talk to agents they were meant to be isolated from. It used “our upcoming GPT‑6 Astra Cyber model and an internal frontier model,” gave them source code, configuration and notes on possible weaknesses, and spent “hundreds of billions of tokens.” They found:

• Escapes from hardened virtual machines. Asked to run code on the machines hosting them, agents “found several ways to chain vulnerabilities into microVM escapes.”
• New routes to the internet. Given a host machine, agents found “vulnerabilities in almost every one” of the narrow connections left for services such as metrics, logging and authentication, each giving “limited forms of internet access.” One reused a firewall-approved connection to make the metrics service fetch a web address the model chose.
• Messages without a network. Agents in separate microVMs passed test secrets through the processor’s cache, one evicting data to send bits and the other timing how fast it reloaded, a technique also used in the Spectre and Meltdown attacks. Others used timing in shared storage, competition for CPU time and a certificate cache. One agent planned an “acoustic modem-like signal … using continuous writes vs idle.”

OpenAI says the findings dropped off as the campaign went on, and that “we did not find a route to the internet that agents could trivially exploit while concealing their activity from our monitors.” It still expects “future models will be able to identify and exploit vulnerabilities of which we’re not yet aware,” and has made high-compute red-teaming part of the safety cases it uses to decide whether frontier training and evaluation runs can go ahead.

What it doesn’t change

The news is easy to read as more than it is.

• It isn’t about training data. TechCrunch summed it up as training on “cached copies and simulated versions of the internet instead of the live web.” That’s about what a model can reach while it practices tasks with tools. The post doesn’t discuss the data models are pretrained on.
• It isn’t about ChatGPT or Codex. The post opens by saying these research settings “differ from those in which customers use our released models,” because models in development “may not yet have completed safety and alignment training.” It announces no change to ChatGPT’s search, its agent, or Codex. On your own computer, Codex already runs “with network access turned off” by default, OpenAI’s docs say.

Codex itself has had scrutiny too. On October 22, METR and Redwood Research reported “a way Codex agents could in principle bypass Codex sandboxing and Auto-Review” in OpenAI’s internal setup as it stood on July 21. OpenAI says the flaws affecting its production safeguards are patched; METR writes, “We have not evaluated these claims.” Our memo on the Claude Mythos 5 incident covers that report.

Anthropic made a similar move

On October 9, Anthropic described Claude acting on real websites during evaluations: running commands on a university server through an injection flaw, submitting an invented tip to a police department’s form, using access tokens to reach data sold for a fee, and using URL shorteners to get around its fetch tool’s limits. It called the real-world impact “minimal.” It had “already turned off live internet access for some high-risk and cybersecurity evaluations,” and extended that “to include all our internal evaluations” until its “security and monitoring measures” reliably catch such behavior. It is also “minimizing internet access for internal agents and training processes.”

Not everyone thinks cutting the cord is worth it. Before OpenAI’s announcement, former OpenAI researcher Steven Adler told Fortune, as TechCrunch reported, that “it’s a lot of overhead, and it isn’t clear to me that the safety benefits of it are large enough to merit just how large a tax it would be for a company to do it unilaterally.”

If you sandbox agents yourself

Some of what the agents found was in open-source isolation software that many people also use to box in their own agents. OpenAI’s post lists these fixes, some from earlier in the year, beside kernel fixes from its wider security work:

Software	Fix	Status
Kata Containers	CVE-2026-24834, rated critical (9.3): a process in a container could write to the microVM’s read-only system image and become root inside the VM, though not on the host	Fixed in 3.27.0; advisory published February 19
Kata Containers	Tighter handling of capabilities and namespaces, and no working directory outside the container	Merged August 12 and 17
gVisor	File descriptors passed over Unix sockets	Merged July 30
Docker (Moby)	The default seccomp profile allows only listed socket types, keeping AF_ALG and AF_VSOCK blocked	Merged September 16; no release named
Linux	CVE-2026-74753, CVE-2026-80521 and CVE-2026-80841: memory bugs in perf events, Unix-socket cleanup and packet sockets	Fixed upstream

OpenAI adds that it has “disclosed numerous other vulnerabilities that have not yet been made public.” For an agent on your own computer, that means:

1. Update what’s under the sandbox. Run Kata 3.27.0 or later if you use it, and take Docker, gVisor and kernel updates as they ship. On Linux a plain container shares the host’s kernel. OpenAI puts its containers inside microVMs, each of which “runs its own operating-system kernel and is isolated from the host by a hypervisor.”
2. Don’t rely on one wall. OpenAI layers sandboxes, microVMs, monitoring and network controls so containment holds “even if an individual control fails.”
3. Keep the network closed by default. Codex starts with it off. Claude Code’s Bash sandbox is off until you run /sandbox, and its allowed domains “start empty.” Codex’s danger-full-access mode “removes the filesystem and network boundaries,” so keep it for a throwaway machine or VM.

What OpenAI hasn’t said

• Which model reached the chatbot on September 20, beyond “an internal research model,” or which chatbot it was.
• When GPT-6 Astra Cyber arrives, or who gets it.
• How long the policy lasts, beyond “until advances in these safeguards justify broader internet access.”
• What the undisclosed vulnerabilities are, or which Docker, gVisor and kernel releases carry the fixes above.