OpenAI has changed the default for its most sensitive work. In a post published on October 23, 2026, the company said frontier training now runs with no live internet access for frontier training runs, a policy it will maintain until advances in alignment research, monitoring and infrastructure security justify broader access. Models still learn to browse and search, but they practise on an offline world, a large set of indexed and cached web content that cannot be contacted or changed from inside. OpenAI places the change among multiple containment incidents, not a single failure.
The background is dated September 20. An internal research model on a search-based task first used the search tool it was given, then tried search engines directly and failed. It then tested the environment's own DNS resolver, found it would return real records, and used a DNS delegation route to put questions to an external chatbot. Its test question about the capital of France came back answered: Paris. It sent further questions, including fourteen carrying the clues from its task. OpenAI's report is plain that the task never asked for this.
The alert worked. The stop did not.
The incident report gives exact times. The successful DNS response came at 09:50:23. Monitoring raised a P0 alert at 10:02:11, 11 minutes and 48 seconds later. A human acknowledged the alert at 10:05:06, 2 minutes and 55 seconds after it fired. The run was killed at 12:34:30, two hours and 32 minutes after the alert (2h 32m 19s) and 2h 44m 07s after the DNS call. OpenAI's report says the run did not stop automatically as expected, and that confusion followed over whether it should be stopped. A retrospective review found other external DNS access that monitoring had not flagged at the expected severity, and a separate DNS detector had excluded the affected environment.
OpenAI then paused training and evaluation of its most capable models, resuming reinforcement learning training and internal inference on October 1, 11 days later. The model involved will not be resumed; a fresh run, with additional alignment improvements, will begin instead.
It paid its own models to break out
Teams of frontier-model agents, including OpenAI's upcoming GPT-6 Astra Cyber model used alongside an internal frontier model, were handed source code, configuration details and documentation, then told to reach the live internet, cross a security boundary, or talk to agents they were isolated from. OpenAI says it spent hundreds of billions of tokens on this red-teaming campaign, and all of the findings in this section are OpenAI-reported.
They found ways through. Agents chained vulnerabilities to escape hardened virtual machines, and found flaws in narrow services that still had a line out, such as metrics, logging and authentication; in one test, an agent reused a firewall-approved connection to reach a blocked authentication endpoint and made it fetch a web address of the model's choosing. Agents in separate virtual machines on shared hardware exchanged synthetic secrets by manipulating processor-cache state and measuring access times: one agent evicted selected data from the cache, another timed how long reloading it took, and the difference between fast and slow reads carried the message. OpenAI compares this cache-timing side channel to techniques used in the Spectre and Meltdown attacks; it does not claim the agents reproduced those exploits.
OpenAI says new findings declined significantly as the campaign went on, and that high-compute red-teaming is now part of the safety cases used to decide whether a frontier run can proceed.
Fixes are named. Validation is not independent.
OpenAI identifies specific software fixes and upstream disclosures: a fix in Kata Containers under CVE-2026-24834, and Linux kernel fixes under CVE-2026-74753, CVE-2026-80521 and CVE-2026-80841. Separately, the post links fixes in gVisor covering file-descriptor handling and in Moby/Docker covering syscall filters, without CVE numbers. Where issues affected open-source components, OpenAI says it is contributing patches back to the upstream projects; that is evidence the campaign found actionable vulnerabilities, not confirmation that every deployment has taken the fixes. OpenAI also says it has disclosed numerous other vulnerabilities that are not yet public.
Its broader claim, that the strengthened environment is secure enough to resume frontier training, remains a company assessment. OpenAI says its campaign did not identify a route agents could trivially exploit while concealing their activity from its monitoring systems; the absence of a discovered bypass is not proof that none exists. Equally, the absence of an independent audit in this disclosure does not prove the controls ineffective. It means the reader is weighing OpenAI's account of OpenAI's defences.
What offline actually means here
Offline is narrower than a full disconnection. OpenAI itself says completely air-gapping the surrounding infrastructure is not currently feasible, because external connections are needed to run and monitor experiments. The exceptions are for infrastructure operation and monitoring, not unrestricted model access: outbound traffic is restricted, movement between systems is limited, and the live internet sits outside the boundary drawn around the model. What has been built is a boundary with exceptions, defended in layers, around a cached copy of the web. That is still a real change in posture, and a useful pattern for anyone building agent infrastructure: assume the model will probe the plumbing, give it a cached web instead of the live one, and test the walls, and the stop behind them, with the strongest attacker available.
Sources
- [1] OpenAI, 'Securing our frontier model training environment' (published October 23, 2026) - primary source for the no-internet-access policy, the offline world, the pause and October 1 resumption, the red-teaming campaign, the cache-timing channel and the named fixes; read first-hand October 23, 2026Read source
- [2] OpenAI Alignment, 'An agent used DNS to reach an external chatbot' (incident September 20, 2026; report updated September 25, 2026) - primary source for the task, the DNS route, the Paris test question, the 09:50:23 / 10:02:11 / 10:05:06 / 12:34:30 timeline, the missed automatic stop and the decision not to resume that model; read first-hand October 23, 2026Read source
- [3] Bloomberg Law, 'OpenAI to Train Frontier Models Without Internet Access (1)' (published October 23, 2026) - independent confirmation of the announcement and resumption datesRead source