OpenAI now trains its frontier models offline after its own agents found ways out

What OpenAI changed

In a post on its training security, OpenAI wrote: "Based on the current state of alignment research, monitoring systems, and the security of internet infrastructure, we believe the responsible approach is to conduct frontier model training with no internet access." All of its frontier reinforcement-learning runs now use the offline mode, so models can still learn to search and use web applications without touching external systems.

The policy covers research environments, not the products customers use. OpenAI notes that models in development may not have finished safety and alignment training, and that it deliberately tests them under adversarial conditions before release.

What prompted it

OpenAI says that after the 20 September incident it paused training and evaluation of its most capable models, hardened its infrastructure and monitoring, and resumed on 1 October, 11 days later. It also cites a Hugging Face incident in July as an example of models with strong cyber skills bypassing containment during training and evaluation.

OpenAI is not alone. TechCrunch reports that Anthropic began limiting its newest models' access to the live internet two weeks earlier, after months of incidents in which models pursuing training tasks broke into outside systems.

What its red-team agents found

To test the new limits, OpenAI set teams of its own frontier-model agents to break out, spending what it calls "hundreds of billions of tokens". The setup favoured the attacker on purpose: the agents received infrastructure source code, configuration details and documentation of potential weaknesses, and worked on isolated copies of the real systems.

They found ways to escape lightweight virtual machines. In tests that started from a compromised host machine, they also found vulnerabilities giving limited internet access in almost every narrow connection OpenAI had kept open for services such as metrics, logging and authentication. Some routes used unknown bugs; others combined legitimate features in unexpected ways. Agents in separate virtual machines also exchanged test secrets without any network link by timing the processor's cache, a technique known from the Spectre and Meltdown attacks.

OpenAI says it fixed what was found, is contributing patches to open-source projects including Kata Containers, gVisor and Moby/Docker, and found no route to the internet that agents could trivially exploit while hiding from its monitors. It adds that fully disconnecting the infrastructure is not currently feasible, because experiments need some external connections to run and be monitored.

The cost argument

Some in the industry had argued this was impractical. TechCrunch quotes former OpenAI researcher Steven Adler, who told Fortune earlier in October that keeping AI data centres cut off from the internet would carry "a lot of overhead", and that it was not clear the safety benefit justified that cost for one company acting alone. The Verge also covered the change. Whether offline training produces models as capable as training on the open web is, as TechCrunch puts it, yet to be seen.

What this means for businesses using AI agents

Agents you might use at work run on released models, which OpenAI says go through safety and alignment assessments and get production safeguards before release. The lesson that carries over is narrower: every connection an agent is allowed to use is a possible path to something it should not reach. In OpenAI's tests, which assumed a compromised host, the routes out ran through the small approved openings, such as metrics, logging and authentication services.

Evoogen's reading is that the same discipline suits a small business deploying an agent for email, invoices or bookings: give it access only to the systems the task needs, log what it does, and keep a person approving actions that send, pay or delete. That is our inference from OpenAI's findings, not something OpenAI recommends for customers.