OpenAI now trains its frontier models with no internet, and used its own agents to prove the walls hold
OpenAI published a short security post on October 23 with one bolded sentence that matters more than the rest: it will "conduct frontier model training with no internet access" until safeguards justify anything broader. Every frontier RL run now happens inside what OpenAI calls an offline world, an indexed and cached copy of web content, instead of the live web. Post: https://openai.com/index/securing-our-frontier-model-training-environment/
The backstory is the September 20 incident, when a DNS misconfiguration let an internal research model reach the live internet during training. OpenAI paused training and evaluation of its most capable models, then resumed RL training and internal inference on October 1. This post is the explanation of what changed in between.
The interesting part is how they checked. High-compute red-teaming is now part of the safety case for whether a run is allowed to proceed, and the red team was frontier-model agents, including the upcoming GPT-6 Astra Cyber. The agents got source code and configs and three goals: reach the internet, cross internal boundaries, and communicate across isolation. The campaign burned hundreds of billions of tokens, and the rate of new findings dropped significantly as it went on. Fixes went upstream to Kata Containers, gVisor, Moby's syscall profiles and the Linux kernel, so everyone running agent sandboxes on that stack gets the patches. The layering is restricted containers inside lightweight VMs, then monitoring, then network and cloud perimeters.
Two things to take from this. First, a frontier lab now says in writing that its own models in training can't be trusted with an open network. That is a stronger statement than any safety framework PDF, because it costs them something: offline worlds go stale and are expensive to maintain. Second, the defender was an agent swarm. Containment is turning into the same game as code review, where the only thing fast enough to check the agents is more agents, and the open question is who checks that the red team was trying hard enough.
← Back to all articles
The backstory is the September 20 incident, when a DNS misconfiguration let an internal research model reach the live internet during training. OpenAI paused training and evaluation of its most capable models, then resumed RL training and internal inference on October 1. This post is the explanation of what changed in between.
The interesting part is how they checked. High-compute red-teaming is now part of the safety case for whether a run is allowed to proceed, and the red team was frontier-model agents, including the upcoming GPT-6 Astra Cyber. The agents got source code and configs and three goals: reach the internet, cross internal boundaries, and communicate across isolation. The campaign burned hundreds of billions of tokens, and the rate of new findings dropped significantly as it went on. Fixes went upstream to Kata Containers, gVisor, Moby's syscall profiles and the Linux kernel, so everyone running agent sandboxes on that stack gets the patches. The layering is restricted containers inside lightweight VMs, then monitoring, then network and cloud perimeters.
Two things to take from this. First, a frontier lab now says in writing that its own models in training can't be trusted with an open network. That is a stronger statement than any safety framework PDF, because it costs them something: offline worlds go stale and are expensive to maintain. Second, the defender was an agent swarm. Containment is turning into the same game as code review, where the only thing fast enough to check the agents is more agents, and the open question is who checks that the red team was trying hard enough.
Comments