OpenAI says models are prohibited from directly accessing the internet during training

This decision stems from concerns about the rapid improvement in AI model capabilities. In a technical blog post, OpenAI pointed out that models under development may not have completed safety and alignment training, and that the company deliberately tests models under adversarial conditions to expose weaknesses. The Hugging Face incident in July of this year, as well as multiple previously observed cases of model "misalignment," indicate that models with complex cyber capabilities may bypass isolation measures during training and evaluation and access external systems.

To let models learn to browse, search, and process web applications without opening up the live internet, OpenAI built an "offline world"—a closed environment containing a large amount of indexed and cached web content. Models can interact within it but cannot affect external systems. All frontier reinforcement learning training uses this offline mode.

For isolation mechanisms, OpenAI adopted a "defense-in-depth" strategy: restricting the resources models can access and execute through sandboxes, using virtual machines to isolate the execution environment from the host computer, deploying monitoring systems to detect unauthorized activity, and setting up multiple protections at network and cloud boundaries. OpenAI emphasized that these controls overlap, so even if one layer fails, overall isolation can still be maintained.

To test the strength of the defenses, OpenAI also launched a high-compute "red team test," using its strongest models, including the upcoming GPT-6 Astra Cyber, to form agent teams that attempted to break through boundaries. Test goals included accessing the live internet, crossing internal security boundaries, and communicating with other isolated agents. OpenAI said these experiments cost hundreds of billions of tokens, uncovered previously unknown open-source software vulnerabilities and infrastructure misconfigurations, and have led to patch fixes and disclosures.

The red team test found multiple attack paths, including achieving virtual machine escape by chaining vulnerabilities, using narrow connections in metrics and logging services to access the internet, and passing information between isolated agents through side channels such as processor cache timing, shared storage, and CPU time contention. OpenAI said it has added monitoring checks for these channels and fixed the related weaknesses.

Notably, on September 20, an internal research model used a DNS resolver misconfiguration to gain limited access to the live internet during a training run. OpenAI said it contained the incident and subsequently paused training and evaluation of its strongest models, using the pause to further harden infrastructure, strengthen monitoring, and improve automatic stop systems.

After completing evaluation and remediation, OpenAI resumed reinforcement learning training and internal inference for frontier models on October 1, only 11 days after the pause began. The company said the red team test did not find an internet path that agents could easily exploit and that could hide activity from monitoring, but emphasized that security hardening work will not end.

OpenAI also listed several follow-up measures, including continuously improving virtual machine security, conducting joint red team testing with cloud service providers, scanning code and configurations, testing monitoring and automatic pause systems, and incorporating high-compute red team testing into the safety cases for future frontier model training. The company said that as model capabilities increase, strengthening isolation, monitoring, and red team testing will become a core part of "responsibly controlling the pace of frontier model development."