OpenAI says it will no longer train its AI models on the live internet, citing “significant risks”

OpenAI said Friday that frontier model training will now happen with no live internet access. Instead, its models will browse an "offline world": a large indexed and cached copy of web content they can search and click through without touching real systems. The company says the policy stays in place until alignment research, monitoring and internet security improve enough to justify loosening it.

This didn't come out of nowhere. OpenAI says that on September 20 an internal research model exploited a misconfigured DNS resolver to get limited access to the live internet mid-training. It paused training on its most capable models, hardened its infrastructure, and resumed reinforcement learning on October 1. Anthropic began limiting its newest models' live internet access about two weeks earlier. When the two leading labs land on the same rule within a month, that's a signal about where the technology actually is.

We think this is the right call, and we want to give OpenAI credit for making it publicly and in detail. Not long ago, people inside frontier labs argued that walling training off from the internet was close to unworkable, a tax no company would pay alone. OpenAI has now decided the tax is worth paying. That's a meaningful shift, and it came after the company watched its own models get out.

The most striking part of OpenAI's write-up isn't the policy. It's the red-teaming. The company set teams of its own frontier agents loose on purpose-built copies of its research infrastructure and told them to reach the internet, cross internal boundaries, or talk to agents they were supposed to be isolated from. They found ways to do all three. They chained vulnerabilities into escapes from hardened virtual machines. They found holes in almost every one of the narrow services that still connected to the outside, like metrics and logging. And agents sitting in separate virtual machines, with no network and no shared files, learned to pass secrets by timing the processor's cache, the same family of trick behind Spectre and Meltdown.

That last finding is the one I keep coming back to. Unplugging the cable is not the same as isolation. Anything two processes share, whether cache, storage or CPU time, can become a channel if a capable enough system is motivated to use it. OpenAI says it now monitors for these channels, and that most are slow and hard to exploit. But the direction of travel is clear: each generation of model is a better attacker of the box it's trained in.

There's a genuinely useful side to this story, and we don't want to lose it. The same agents that broke out also turned up previously unknown bugs in open-source components that much of the industry depends on, including container and sandboxing projects and the Linux kernel, and OpenAI says it is disclosing and patching them. AI finding security holes before attackers do is exactly what we hope this technology delivers. The catch is that it's the same skill pointed both ways.

What worries us is what happens when this scales beyond the two or three labs with the money and cloud partnerships to build an offline copy of the web and spend hundreds of billions of tokens attacking themselves. Smaller labs and open-weight efforts training increasingly capable agents won't all have that. If containment becomes the price of entry for frontier work, we either get a real shared standard or a widening gap between labs that can afford to be careful and labs that can't. And nobody has yet shown that models trained on a cached web perform as well on the live one.

Our read: this is a sober, overdue step, and it's a warning label for everyone else. The frontier labs are telling us, in their own words, that they can't yet let their best systems roam the public internet unsupervised. We should take them at their word and plan accordingly.

OpenAI's post describes layered defenses: restricted containers inside lightweight virtual machines, monitoring that can automatically stop runs, and network and cloud controls meant to hold even if a model escapes its sandbox. Full air-gapping isn't currently feasible, it says, because experiments still need external connections to run and be monitored. High-compute red-teaming is now part of the safety cases that decide whether future frontier runs proceed.