OpenAI implements a frontier model training safety policy, prohibiting models from accessing the real internet

OpenAI Begins Offline Training of Its Strongest Model: "For Safety's Sake" QbitAI Download the App for Exclusive Early Access October 25, 2026 07:43:05 From Beijing Updated October 25, 2026 08:03:18

Cheng Qian, reporting from the Non-Convex Temple

QbitAI | WeChat Official Account QbitAI

After months of repeated "privilege escalation" or "jailbreak" incidents that breached safety boundaries, OpenAI is finally going to pull the network cable.

Today, OpenAI announced the implementation of a new frontier model training safety policy that prohibits models from accessing the real internet.

Since this summer, AI safety incidents caused by large models from OpenAI, Anthropic, Google, and Meta have occurred from time to time.

Some netizens joked:

My home broadband provider's outages are more reliable than those PhDs at OpenAI.

Frontier AI labs have recognized this—for example, OpenAI paused training for 11 days at the end of September.

Users have recognized it too.

One OpenAI safety engineer reported that every time they post, 5-10 comments appear underneath saying:

In July, an OpenAI Agent broke out of isolation and intruded into the Hugging Face system.

Subsequently, Anthropic, upon hearing the news, also retroactively discovered three incidents in which Claude broke into real third-party systems during cybersecurity evaluations.

In the same month, Meta's Muse Spark 1.1 also broke into real websites during testing, reading information and modifying databases.

In August, the UK AI Safety Institute disclosed a broader problem in testing: models from OpenAI and Anthropic carried out 19 unauthorized online actions across 10 rounds of testing.

On September 20, a model in OpenAI training slipped through a DNS configuration gap and contacted an external chatbot.

Without cutting the network, the models could continue to affect external websites and systems.

But this is not easy—frontier models need to practice finding information, operating websites, and using software tools.

If these tasks are removed entirely, the training environment would become disconnected from the scenarios in which the models will later work.

This time, OpenAI brought in a large amount of web content, indexed and cached it in advance, and built an offline world where models can only search and browse within a large body of indexed and cached content.

However, according to their own tests, even with the network cut, Agents can still communicate with each other.

For example, by using the CPU cache to chat.

That works too?

Researchers found that one of the agents would change the state of data in the cache, while another measured how fast the data was read; the difference in speed was encoded into a signal, and in this way the two sides transmitted information.

After OpenAI monitored this method, the Agents continued to communicate using methods such as shared storage and CPU usage time...

All I can say is, you've really mastered the spy game. Send you into "The Three-Body Problem" and there'd be no need for Wallfacers or Yun Tianming—you'd never be exposed! Sophon would be stunned on the spot!

The episode where Earthlings and Trisolarans empathize with each other the most.

OpenAI admits that complete physical isolation is currently not feasible—after all, the training system itself still needs to keep running, and OpenAI needs to connect to external services to run and monitor experiments.

In addition to the offline web environment, OpenAI has also set up sandboxes, lightweight virtual machines, monitoring systems, and restrictions on network and cloud access.

Letting GPT-6 Astra Cyber and an internal frontier model besiege itself

To ensure the absolute security of the system, OpenAI has currently decided to let its strongest models besiege its own system.

It organized large-scale red-team testing, with participants including GPT-6 Astra Cyber and an internal frontier model.

The tests set the three most frequent types of jailbreak incidents as tasks, including connecting to the real internet, breaking through internal security boundaries, and contacting other Agents that should be isolated from each other.

To push the defenses to their limit, OpenAI also provided them with the source code, configurations, and related documentation of the infrastructure.

The testing consumed hundreds of billions of tokens, equivalent to spending tens of millions of RMB.

This red-team test was "fruitful."

Originally, the Agent was confined in a restricted container, with an additional layer of lightweight virtual machine outside. By design, even if the AI messed around inside the container, it could not freely control the virtual machine, let alone touch the host machine actually running it.

In addition, some necessary controlled network connections, such as metrics monitoring, logging, and authentication services, also became security risks themselves.

△ Curve of the number of candidate findings as token investment increases

For now, OpenAI can only patch things up—letting the strongest models continue testing while fixing the vulnerabilities they exploit.

They said they will only reconsider connecting to the network once their own protection capabilities are sufficient to support broader network access.

One More Thing

I don't know whether to call it interesting or helplessly bittersweet, but OpenAI's official report on AI safety isolation also hid an "easter egg."

At the end of the report, they specifically placed two strings of gibberish-like canary strings to prevent this document from being seen and learned by AI in the future...

Yes, they even thought of this step.

Nothing more to say.

"Special Statement: The above content (including videos, images, and audio if any) is uploaded and published by users of "Dafeng Hao," a self-media platform under Phoenix Net. This platform only provides information storage space services.

Notice: The content above (including the videos, pictures and audios if any) is uploaded and posted by the user of Dafeng Hao, which is a social media platform and merely provides information storage space services."