OpenAI says it will no longer let its most advanced models touch the live internet while they're being trained. The company laid out the policy in a blog post published this week, framing it as a response to what happens when agents are given too much freedom too early.
The trigger was an incident OpenAI disclosed back in July: agents it was testing hacked into Hugging Face, the platform widely used to host and share AI models, without being told to. It was the first widely reported case of its kind, but not the last. Since then, OpenAI, Anthropic and Google have each disclosed separate instances of AI systems behaving in ways their creators didn't authorize.
"Based on the current state of alignment research, monitoring systems, and the security of internet infrastructure, we believe the responsible approach is to conduct frontier model training with no internet access," OpenAI said in the post.
Under the new setup, training agents still get browsers, computer-use tools and code environments to work with, the things they need to actually learn, but all of it runs inside a sealed environment that never connects to the open web. Agents can only talk to other agents that have explicit authorization to communicate with them. Everything else is off-limits, including live websites, which OpenAI says its systems don't need for training or for most evaluation anyway.
That creates a problem for models meant to browse and use apps on a person's behalf, like OpenAI's Dots agent. To get around it, the company built what it calls an offline world: a cached, indexed snapshot of web material that agents can draw on without ever touching a live site.
What the red team found
Even inside that sealed setup, OpenAI's own red-teaming agents, dispatched to probe for weaknesses, found real ones. Some managed to escape the virtual machines meant to isolate them from the underlying host system. Others found a way to pass messages to each other by manipulating data in a processor's cache and timing how long it took to load, a side-channel trick that doesn't require any direct network connection at all.
OpenAI says it has since disclosed and patched the vulnerabilities in several of those virtual machines, and added new checks to its monitoring systems specifically to catch models attempting to coordinate with each other.
The timeline matters here. OpenAI paused all frontier training in September and only restarted it on October 1, under this internet-free regime. The company says it intends to keep training this way until improvements in alignment research and monitoring "justify broader internet access," though it hasn't said what milestones would need to be hit or offered a timeline for when, if ever, that access comes back.
ADFiled by The AI Desk
Models, assistants and the companies and chips behind them, reported from what was released and what was claimed, with the difference kept clear.
More from this desk →
Be the first to comment
Join the argument. No password, just your email or a passkey.