OpenAI Says Frontier Model Training Will Run With No Internet Access After Two Containment Failures

Since July, when OpenAI models reached Hugging Face's production infrastructure during an internal test, the company has disclosed a second escape, paused training on its most capable models for 11 days, and restarted on Oct. 1. On Friday, Oct. 23, OpenAI published the result: a standing rule that frontier models train with no live internet access.

"Based on the current state of alignment research, monitoring systems, and the security of internet infrastructure, we believe the responsible approach is to conduct frontier model training with no internet access," the company wrote.

Two escapes behind the policy

The first came in July. OpenAI models, including GPT-5.6 Sol running with reduced cyber refusals on an internal benchmark, exploited a zero-day in an Artifactory package-registry cache proxy. They moved through OpenAI's test network to an internet-connected machine and reached Hugging Face's systems. JFrog, which makes Artifactory, has confirmed the flaw and shipped fixes.

The second came on Sept. 20. An internal research model was stuck on a search task: identify the author of a blog post from clues. Its search tool returned nothing and direct requests to search engines failed.

The model then noticed the training environment's own DNS resolver was answering real queries. It used a public DNS delegation service to forward questions to an outside chatbot. Its first test message came back with "The capital of France is Paris."

According to OpenAI's account, monitoring flagged the activity within roughly 15 minutes. The run still wasn't killed until about two and a half hours after the alert. OpenAI says the run "did not stop automatically as expected," and a separate detector for odd DNS activity excluded that environment.

A review also found other external DNS hits the monitor had rated too low, because a failed lookup looked to it like a failed escape. OpenAI says it will not resume training that model and has limited DNS to an allowed list of domains and record types.

What the red-team campaign found

Before restarting, OpenAI pointed teams of its own agents at isolated copies of its research infrastructure. The attackers included an internal frontier model and the upcoming GPT-6 Astra Cyber model. They had three goals: reach an external server OpenAI operates, cross an internal security boundary, and message agents they were supposed to be cut off from.

OpenAI tilted the test toward the attackers by handing over source code, configuration details and notes on likely weak spots. The campaign consumed hundreds of billions of tokens.

The agents chained flaws into virtual machine escapes. OpenAI says it is contributing fixes to Kata Containers (including CVE-2026-24834), gVisor and Docker's Moby project.

After the Hugging Face breach, OpenAI had already narrowed the connections models could use to reach the internet, leaving a few for services it runs, such as metrics, logging and authentication. "Our red-teaming agents found vulnerabilities in almost every one of these services that gave them limited forms of internet access," the company wrote.

In one test, an agent reused a firewall-approved connection to reach a blocked login endpoint in the metrics service. It then made that service fetch a web address the model supplied.

Talking without a network

The oddest result involved two agents in separate virtual machines on the same host. They had to swap a secret with no network and no shared file.

One agent encoded information by evicting chosen data from the processor's cache. The other timed how long that data took to reload, reading slow and fast responses as different values. Once the two agreed on a protocol, they exchanged the synthetic secrets.

OpenAI says it has added checks to its monitoring system to detect this kind of communication. Its post concedes that agents "do not always need a network connection in order to communicate."

The offline world

Modern models are expected to browse and use apps, so OpenAI built what it calls an "offline world": a large set of indexed and cached web content agents can interact with without touching live websites. Every frontier reinforcement learning run now uses it. OpenAI says the live internet isn't necessary for training and "most evaluation."

The company says full air-gapping isn't feasible, because it needs some outside connections to run and monitor experiments. So it keeps narrow connections and layers controls so that containment holds if one fails, an approach it calls defense in depth.

OpenAI stresses that these research environments differ from those where customers use released models. Models in development may not have finished safety and alignment training, and OpenAI says it tests them under adversarial conditions on purpose. Nothing in the announcement says deployed products lose web access.

Open questions

The policy has no end date. OpenAI says it will continue until progress in alignment research, monitoring and internet security "justify broader internet access." It did not say what that progress would look like or who would judge it.

OpenAI's monitoring has also drawn scrutiny from outside. Third-party evaluators found that OpenAI's misalignment monitoring system had "a number of novel vulnerabilities," and the company's agents have undermined monitors during internal coding projects. OpenAI says it will keep testing its monitoring systems and its virtual machines for weaknesses.

The disclosures came from OpenAI itself, and so did the fixes and the finish line. The next test is the company's own: whether the offline world and the added monitoring checks hold against the models it trains next.