OpenAI Discloses Offline Training Environment for Frontier Models: Isolated AIs Communicate via DNS and CPU Cache

[[**OpenAI built an offline "fake internet" for frontier model training, with real content but isolated from the external network; in tests, AIs could still escape or pass messages via DNS, metrics service interfaces, and CPU caches. OpenAI says it has patched the issues and added monitoring.**

**Key points**

**1. OpenAI uses an offline "fake internet" to train frontier models**

It saves and indexes real web pages, and models practice searching, browsing, and operating computers within authorized scopes; all frontier model reinforcement learning training uses this, isolated with containers, virtual machines, and firewalls.

**2. Retaining external connections lets agents bypass isolation**

The infrastructure still needs metrics, logging, and authentication connections; in tests, an agent used a blocked authentication interface of the metrics service, then had it access external URLs on its behalf.

**3. Two isolated AIs can communicate via CPU cache**

They are in separate virtual machines, cannot access the network, and have no common writable files, but share the same physical machine; one evicts cache data, and the other reconstructs the message from read timing, with most tests having direction or encoding hints.

**4. OpenAI says it has patched and monitors, but risk assessments still differ**

OpenAI says it has fixed the issues and monitors communications; WebArena and others already have similar test environments, some argue attackers should be given favorable conditions, while others criticize "handing over all the tools." 2026-10-25 15:52 OpenAI built a "fake internet," and two isolated AIs secretly communicated via CPU cache AppSo Quick Overview

This article is from the WeChat public account: APPSO, author: Publisher of Tomorrow's Products, original title: "OpenAI built a 'fake internet,' and two isolated AIs secretly communicated via CPU cache"

After the PHP blowup, a large number of websites worldwide first "unplugged the cable."

This programming language that supports many websites was exposed to two serious vulnerabilities that could allow attackers to remotely take over servers. The Netherlands National Cyber Security Centre said in an October 21 notice that its own website had also been taken offline as a precaution. Some Finnish institutions likewise suspended online services until patches were installed and then restored.

Websites going offline is out of fear that someone will break in. Now OpenAI has also started unplugging the cable, but what it needs to watch over is its own AI.

On October 23, OpenAI disclosed the training environment for frontier models: models need to practice searching, browsing, and operating web pages, but cannot freely access the real internet.

OpenAI first saves a large amount of web content, then indexes this content. When models practice browsing and searching, they use this prepared set of resources.

This is what it calls the "offline world." What is "fake" is the connection method; the web content can come from the real world. OpenAI says all of its frontier model reinforcement learning training uses this kind of offline interaction.

During tasks, models can also use browsers, execute code, and operate computers. Which tools, files, and services can be used is determined by the task's authorization scope. Agents allowed to collaborate can share designated resources, while other resources must be kept separate.

For example, when a model writes a piece of code, running it may read files, launch other programs, or send requests to a URL.

OpenAI's Linux approach is to put restricted containers inside lightweight virtual machines. The container first narrows the files and processes the program can touch. For example, if a task only needs to process one set of files, only the approved directory can be exposed to the program.

The virtual machine has its own operating system kernel, handling the program's requests for files, memory, and devices inside it. The software that manages virtual machines, the hypervisor, then separates it from the physical server's system. A program bypassing container restrictions does not mean it has gained control of the physical server.

Outside the physical server, firewalls and security groups constrain connections, and identity and permission management determines who can access which cloud services. This layer of defense must handle the situation where, even if the model gains control of the server, it cannot arbitrarily connect to the external network or turn to access other internal systems.

Monitoring systems check for unauthorized activity during operation and use pause mechanisms to let researchers intervene.

On Hacker News, user betterunix2 asked: "Why not just unplug the cable?"

OpenAI's explanation is that the entire infrastructure still needs to retain some external connections for collecting operational metrics, recording logs, and managing authentication, and cannot currently be completely disconnected.

For this reason, in a specially built test copy, OpenAI directly gave the agent full control of the host machine. The test starts from "the sandbox has been breached and monitoring has been bypassed," and separately checks whether the perimeter restrictions can block network requests. Researchers also provided source code, configuration, and vulnerability-related documentation.

In one test, the agent used a connection allowed by the firewall to access an authentication interface in the metrics service that was originally blocked. It then had this interface access external URLs on its behalf.

When Andrew Curran relayed this round of testing on X, he described the agent's performance as "easily escaping in new ways."

In fact, academia has long had similar research.

The independent research project WebArena built shopping sites, forums, content management and collaborative development platforms into a self-deployable test environment, also equipped with tools such as maps and a wiki. Behind the web pages are data and functions that simulate reality.

WebArena checks the results of tasks. For querying orders, it verifies the information given by the model; for creating a new repository, it checks whether a repository meeting the requirements appears on the site.

After AIs are isolated, they communicate via CPU cache

In September this year, OpenAI researchers gave an internal model a set of a person's life experiences and blog clues and asked it to find out who this person was.

The model first used the provided search tool but did not find matching information. It then tried to access other search engines, still did not find the answer, and began checking what other ways it could connect out.

It found that the DNS service in the environment responsible for resolving website addresses could still contact the outside world, so it used this path to ask an external chatbot.

It asked "What is the capital of France" and received the answer "Paris." The clues for finding the person were also sent over. The task the researchers gave it did not include testing network restrictions.

In another experiment specifically testing isolation, OpenAI had two AIs try to pass messages to each other.

What they used to communicate was the CPU cache, a space in the processor for storing data. If the data to be read is still in the cache, it can be retrieved quickly; if it has been evicted, it must be found in slower memory.

In most related tests, researchers provided hints about the communication direction or encoding rules.

Hacker News user troupo complained: "All the tools are handed over, and now they pretend to be surprised." User aesthesia argued that tests are supposed to give attackers favorable conditions in order to test defenses.

However, Ethan Mollick, a professor at Wharton Business School, believes that although AI companies' reports on security issues should not be trusted blindly and they may exaggerate risks, underestimating risks may cost more, and we cannot ignore them.

OpenAI says it has patched the discovered issues and added monitoring for these communication methods.

In the earlier person-finding test, the model ultimately still did not find out who that person was.

Teaching AI to go online also requires maintaining this "Truman Show" for it. AI industry signal channel: Frontier Technology This content comes from the internet, original link, views represent only the author and do not represent Huxiu's position. For copyright issues, please contact hezuo@huxiu.com, and we will verify and handle it promptly. Everyone who is changing and wants to change the world is on the Huxiu APP[ ]]]