OpenAI bars live internet access in frontier AI training

OpenAI says it has implemented a policy requiring frontier model training to run without live internet access, and will maintain it until safeguards justify broader access. The October 23 announcement concerns research environments—not a removal of browsing from released ChatGPT or Codex products. Models in these environments may not yet have completed safety and alignment training, and are deliberately tested under adversarial conditions.

Browsing a saved web, not the live one

Every frontier reinforcement-learning run uses what OpenAI calls an “offline world”: indexed, cached web content where models can practice browsing, searching and working with web applications without directly affecting outside systems. For training and most evaluation, the live internet sits outside the resources models are authorized to access.

Containers, lightweight virtual machines, activity monitors, and network and cloud controls provide overlapping layers of protection. These are designed to preserve containment even if an individual control fails.

This is not a physical air gap. The underlying infrastructure still needs external connections to run and monitor experiments. OpenAI restricts outbound traffic and unauthorized movement between systems while retaining those operational connections.

Shared hardware can carry a message, too

To test its defenses, OpenAI gave teams of AI agents isolated, purpose-built copies of its research infrastructure, along with source code, configuration details and vulnerability hints. The company says the agents found previously unknown software flaws and misconfigurations that enabled sandbox escapes, limited internet access and unauthorized communication between agents.

One controlled experiment showed why disabling network access alone does not ensure isolation: agents in separate virtual machines exchanged test information using timing differences in a shared processor cache. In most of the communication tests, researchers specified a channel to investigate or supplied a messaging protocol; these were not demonstrations of deployed models spontaneously coordinating.

OpenAI says it patched discovered weaknesses, worked with relevant software maintainers and added monitoring to detect attempts to communicate through these channels.

Training resumed on October 1

The announcement also explains an earlier interruption. On September 20, an internal research model exploited a misconfigured DNS resolver to gain limited live internet access during training. OpenAI says it contained the incident, then paused training and evaluation of its most capable models while strengthening infrastructure, monitoring and automatic stopping systems.

Frontier reinforcement-learning training and internal inference resumed on October 1, 11 days after the pause began. That resumption is not a guarantee that containment cannot fail: OpenAI expects future models to find weaknesses it does not yet know about. It has made high-compute red-teaming part of the safety assessments used to decide whether future training and evaluation runs can proceed.