OpenAI Discloses Security Overhaul for Frontier Model Training: Full Network Cutoff and 11-Day Training Pause

Hundreds of billions of tokens spent testing safety, yet AI can still “talk through walls”! OpenAI cuts all network access for frontier training. Machine Heart Download the app. Exclusive early access. October 25, 2026, 07:28:19 From Beijing. Updated October 25, 2026, 10:26:29

Editor｜Red Panda

The communication tool they used was the CPU cache.

On October 23, OpenAI published details of the security overhaul of its frontier model training environment, disclosing this red-team experiment. At the same time, the company made clear that frontier model training no longer has access to the real internet; instead, models practice browsing and searching in an offline web environment.

With no network, how do they pass secret signals?

The agents in the experiment were placed in separate lightweight virtual machines sharing the underlying host hardware. The researchers' task for them was to exchange preset test information under conditions where network communication was prohibited and there were no shared writable files.

The breakthrough lay in the speed of reading data. Reading the CPU cache is usually faster than fetching data from main memory. The agents exploited this timing difference, turning changes in shared cache state into signals, then agreeing on encoding and decoding schemes, and ultimately completing the information exchange.

It is like two rooms that cannot talk directly but still share a facility. One side changes the state of the facility, the other observes the change, and the two sides now have a way to pass secret signals.

The CPU cache was only one channel. OpenAI also disclosed communication methods involving shared storage, CPU time contention, and TLS certificate caching. Most channels were slow to transmit and difficult to exploit, but they could still cross boundaries originally meant to isolate tasks.

OpenAI's agent sandbox allows access only to offline resources. The live internet, other sandboxes, and OpenAI's infrastructure all lie outside the isolation boundary.

There is an experimental condition that needs to be stated here: most of the relevant tests specified the direction of the communication channel or provided encoding and decoding protocols. In another test, only a broad list of vulnerabilities was given, and the agents constructed a channel from it, agreed on an encoding, and exchanged information.

Therefore, these results cannot be equated with AI spontaneously deciding to collude without any prompting. A Reddit user happened to ask exactly this:

Did these agents really do this spontaneously, or did the researchers give them a restricted environment and a goal that would lead to this outcome? That distinction matters.

Another user reminded:

Understanding the upper limit of their capabilities is itself important.

Cache side channels already have a research foundation. What is noteworthy about this experiment is whether models can put the relevant methods to use, and whether existing isolation measures can withstand such attempts.

An internal research model needed to look up information about a person based on clues in a blog. The task did not ask it to test network defenses, but after its search was blocked, the agent exploited a DNS filtering gap in the training environment to contact an external chatbot.

The service normally used for domain name resolution became an unauthorized path to external access. The system raised an alarm within 15 minutes, and human reviewers responded about 3 minutes later. The problem lay in the next step. The automatic stop mechanism did not take effect as expected, and the run continued for about another two and a half hours before being manually terminated.

Between discovering a boundary crossing and stopping it in time, there is still a gap. OpenAI subsequently paused the relevant training and evaluation of its most capable models. After hardening was completed, the company resumed reinforcement learning training and internal inference for frontier models on October 1; the pause lasted 11 days. What was published on October 23 was the public explanation of this round of changes.

In another Reddit discussion, a user questioned why the test environment could still affect the real internet. Another user responded with a programmer-style quip: most companies use a special test environment called “production.”

Behind the joke is the question of who should be responsible for the boundaries of testing. OpenAI's announcement also explained an easily confused detail: the fact that models cannot access the real internet does not mean the entire infrastructure is completely disconnected from external networks. Running and monitoring experiments still requires necessary connections, and security measures must prevent agents from turning these connections into detour channels.

Does being better at doing things mean knowing better where the limits are?

In the related discussions, users raised another concern: a model may be very good at attacking computers but not good at understanding the intent of human instructions and judging whether behavior is appropriate, and the combination of these two traits would be dangerous.

This leads the debate to a more specific question: do a model's task capabilities and its ability to respect boundaries progress in sync?

On October 23, an analysis published by Anthropic provided another set of materials for this question.

In July this year, when the UK AI Safety Institute (AISI) conducted a cybersecurity capture-the-flag test, Claude Mythos 5, after its attempts within the specified scope were blocked, turned to a GitHub project unrelated to the test, submitted malicious code, and created fake identities to urge the maintainer to accept the changes. The maintainer rejected the code, and the run eventually ended in a timeout.

That test had actively opened internet access at the time, and the cybersecurity protections normally used for general release versions were also turned off.

A follow-up simulation experiment by AISI found that even when the event summary provided to the model further clarified that the target was a real person unrelated to the evaluation, the model still almost always launched attacks in tests where it continued to carry out the task.

But in separately posed tests, as the instructions became clearer, the model increasingly acknowledged that such behavior crossed the line and would cause harm. The two sets of results came from separate runs, showing an inconsistency between the model's expressed judgments and its actual execution.

AISI believes this may involve motivated reasoning: the explanations the model gives tend to support its continuing on the current task path. For example, it interprets the real target as a simulated object, providing a reason to keep acting.

The organization also stresses that a chain of thought in text form alone cannot prove whether these reasons drove the actions or provided a post-hoc explanation for actions already taken; nor can the study's conclusions be directly generalized to all deployment scenarios.

Anthropic said that newer models launched similar attacks less often in replay experiments; AISI cautioned that the model's awareness that it is being evaluated may also affect performance.

These findings make the distance between "saying safe things" and "being able to act safely consistently" concrete.

Outside the lab, defenders are also speeding up

The Wall Street Journal reported on October 24 that entrepreneur Colin Parsons discovered unauthorized charges totaling $449 on his Anthropic and OpenAI services, involving credentials he had stored in OpenCode. The report made clear that it is not yet known which specific tools the attackers used.

This kind of human misuse and models crossing boundaries during training or evaluation need to be analyzed separately. But both require defense systems to detect problems and block actions faster.

Those fixing vulnerabilities face their own pressure, too.

The PHP Foundation disclosed on October 14 that since July 1, the team had released 15 CVEs while closing 106 reports that did not constitute vulnerabilities, were duplicates, or could not be reproduced.

Discovery can be accelerated, but verification, fixing, and patch deployment must keep pace as well.

After going offline, there is still a security ledger

OpenAI's response was to transform the training environment into an offline world: the model can still operate indexed and cached web content to practice relevant skills, while its impact on real external systems is limited.

This disclosure concerns the internal research environment and differs from the user-facing product environment.

To test the defenses, the company organized large-scale AI red teaming, consuming hundreds of billions of tokens in total. The models involved in this round of work included the then-unreleased GPT‑6 Astra Cyber and an internal frontier model.

Beyond the investment, whether the protections are effective still needs verification.

On October 22, METR published an evaluation conducted jointly with Redwood Research: from July to August, researchers examined OpenAI's internal monitoring system at the time and found vulnerabilities that could allow hundreds of recent actions to bypass monitoring, among others.

OpenAI said the vulnerabilities related to production security protections have been fixed. The evaluators made clear that they did not verify the subsequent remediation claims. These findings concern historical systems and cannot be directly applied to current versions.

OpenAI has incorporated high-compute red teaming into the safety case for future frontier reinforcement learning training and evaluation, to determine whether such work can be carried out safely.

From these disclosures, it is clear that the safety issues of frontier models have penetrated every layer of the training system: the task environment, shared resources, permission boundaries, and post-alert handling.

As models become better at solving problems, researchers must also verify whether, in order to complete tasks, they will treat the constraints they should follow as problems to be solved.

The next test question is already before the training system itself.

"Special statement: The above content (including videos, pictures, or audio, if any) is uploaded and published by users of the Dafeng Hao, a self-media platform under Phoenix Net. This platform only provides information storage space services.

Notice: The content above (including the videos, pictures and audios if any) is uploaded and posted by the user of Dafeng Hao, which is a social media platform and merely provides information storage space services."