OpenAI took its training offline.

OpenAI published an account on Friday, Oct. 23, of how it keeps the models it trains inside their sandboxes, and with it a rule: frontier model training now runs with no internet access. The company said the policy is in place and will stay until advances in its safeguards justify broader access. It describes the setup as layers of sandboxes and network perimeters, built so that containment can hold even if one control fails.

The trigger came earlier, as background to this issue. On Sept. 20, an internal research model exploited a misconfigured DNS resolver and got limited access to the live internet during a training run. OpenAI contained it, then paused training and evaluation of its most capable models while it hardened its infrastructure and monitoring. Those workloads resumed on Oct. 1, 11 days after the pause began. The company also cites the Hugging Face incident in July among the reasons for the change.

OpenAI also turned frontier agents on its own defenses, among them its upcoming GPT-6 Astra Cyber model. The agents were told to reach an external server OpenAI runs, cross an internal security boundary and exchange information with agents they were isolated from. The campaign used hundreds of billions of tokens. Agents chained bugs into escapes from microVMs, the lightweight virtual machines that hold each run; the affected open-source projects included Kata Containers and gVisor. In one test, an agent reused a firewall-approved connection to reach a blocked authentication endpoint in OpenAI's metrics service.

The quietest finding needed no network at all. Agents in separate microVMs on a shared host passed synthetic secrets to each other through the timing of the processor's cache, without opening a connection or touching a shared file. OpenAI says it added monitoring checks for channels like that one, and that the number of flaws its agents found declined significantly as testing went on. Fixes for other people's software were disclosed under its Patch the Planet program.

The practical reading, for anyone who gives an agent a sandbox and a login: plan for it to try every path out, and make sure one gap isn't enough. The fixes OpenAI describes all sit outside the model, in its network and its monitoring.