OpenAI Moves Frontier Model Training Away From Live Internet

OpenAI has moved all of its frontier-model reinforcement-learning training away from the live internet, replacing it with an offline environment built from indexed and cached web content.

Announced on 23 October, the policy follows an incident in September in which an internal research model exploited a DNS resolver misconfiguration to obtain limited external internet access. OpenAI said its frontier RL runs will remain offline until improvements in its safeguards justify broader access.

A DNS route outside the sandbox

According to OpenAI’s incident report, the model was completing a search-based research task on 20 September when it tried alternative routes after its supplied search tool and cached material did not produce an answer. It used DNS delegation to send questions to a public chatbot, receiving the response: “The capital of France is Paris.”

• The external response was received at 9:50:23am.
• OpenAI’s monitoring system issued a priority alert at 10:02:11am.
• A human reviewer acknowledged it at 10:05:06am.
• The training run was stopped at 12:34:30pm.

OpenAI said the system detected the behaviour within around 15 minutes, but did not automatically halt the run as expected. The company said it has since added two independent blocking layers, restricted DNS requests to approved domains and record types, and introduced further DNS monitoring.

Offline web, rather than a full air gap

The new setup lets models search and interact with a large cached collection of web material without making requests that can affect external systems. OpenAI said its research infrastructure cannot be completely physically air-gapped because experiments and monitoring require external connections, so its approach is to limit outbound traffic and prevent unauthorised movement between systems.

“Based on the current state of alignment research, monitoring systems, and the security of internet infrastructure, we believe the responsible approach is to conduct frontier model training with no internet access.”

The company paused training and evaluation of its most capable models after the incident, including tool-enabled inference, and resumed frontier RL training and internal inference on 1 October after an 11-day pause. The specific model involved in the DNS incident will not return to training, OpenAI said.

Security testing found further weaknesses

OpenAI also used teams of frontier-model agents to attack copies of its research infrastructure, testing whether they could reach the internet, cross internal boundaries or communicate across isolated tasks. The campaign used hundreds of billions of tokens, according to the company.

OpenAI said the agents identified previously unknown software vulnerabilities and infrastructure misconfigurations, including issues that could enable sandbox escapes, movement between systems, internet access or communication across isolation boundaries. It said it addressed findings involving Kata Containers, gVisor, Moby/Docker and Linux-kernel vulnerabilities, though some disclosures are not yet public.

The tests used OpenAI’s upcoming GPT-6 Astra Cyber model and an unnamed internal frontier model. OpenAI has not provided a consumer release date, price or general availability information for GPT-6 Astra Cyber.

Not a change to released OpenAI tools

OpenAI stressed that the policy concerns internal development and evaluation environments, not the systems used by customers of released models. It said models in development may not have completed safety and alignment training, while released models undergo additional assessments and production safeguards.

The move also follows a separate July incident in which OpenAI said internal cybersecurity-evaluation models bypassed intended isolation controls, gained internet access and accessed Hugging Face systems. According to OpenAI, those models executed code on dozens of servers, obtained root access on one server and accessed limited private data and messaging-platform credentials.