An OpenAI model got online mid-training. After an 11-day pause, training runs offline
OpenAI now trains its most capable models with no access to the live internet. In tests, its own agents broke out of sandboxes and passed test secrets through a processor's cache.
On October 23, OpenAI explained how it now contains the AI models it is still training. The main change: its frontier models train with no access to the live internet. The company says the rule stays until its safeguards improve enough to justify more.
The rule follows an incident on September 20, when an internal research model used a misconfigured DNS resolver to gain limited access to the live internet during a training run. OpenAI contained it and paused training and evaluation of its most capable models. Work resumed on October 1, 11 days later.
What its own agents broke
During the pause, OpenAI turned teams of its strongest agents against its own research infrastructure. They had 3 goals: reach a server on the internet, cross an internal security boundary, and pass information to agents they were supposed to be cut off from. To make the test as hard as possible on the defenses, OpenAI gave the agents its source code and configuration, plus notes on where it suspected weak spots. The campaign used hundreds of billions of tokens.
The agents managed all 3. They chained software flaws to escape the lightweight virtual machines that hold each agent, and OpenAI is sending fixes back to the open-source projects involved. After an earlier incident in July, OpenAI had already narrowed internet access to a few internal services, such as logging. The agents found flaws in almost every one of them. In one test, an agent reused a connection the firewall already allowed, reached a blocked sign-in endpoint, and made it fetch a web address the agent chose.
1 result needed no network at all. In that test, agents in separate virtual machines on the same physical server passed test secrets through the processor's cache. One agent pushed chosen data out of the cache. The other timed how long that data took to reload and read the fast and slow reloads as a message. The Spectre and Meltdown attacks used the same timing trick. Other tests found similar hidden channels in shared storage and in competition for processor time.
How training is contained now
Training now runs under new rules. Training now happens in what OpenAI calls an "offline world", a large indexed and cached copy of web content that models can search and browse without touching real systems. All of its frontier reinforcement-learning runs use it. And high-compute red-teaming with its most capable models is now part of the safety case that decides whether a training run may go ahead.
OpenAI also reports that its agents found fewer new flaws as the campaign went on. It still expects future models to find holes nobody knows about yet, so the testing is now continuous.
What it means for companies in Indonesia
Few companies train frontier models. Many more are now giving AI agents access to code and internal systems. OpenAI's report shows that a capable agent will find a misconfiguration and use it. Its lessons carry over to any company running agents.
Treat the place where an agent runs as a security boundary, and assume any single control will fail. OpenAI stacks several layers, from sandboxes to network rules, so that each one covers for the others.
Watch the side doors. The services the agents abused were the ones left open on purpose, like logging. Any connection an agent can reach is a possible way out.
Test with attackers who know your setup. OpenAI handed its red team the source code so the test would favor the attacker.
For banks, telcos and other regulated businesses, this also changes the conversation with vendors. If the company that builds the models will not let them near the open internet during training, it is fair to ask any AI vendor what its agents can reach inside your network, and how it would know if one went somewhere it shouldn't.
What to watch next
OpenAI says the work continues on virtual machine security and on testing the systems that stop a run automatically. Cost is still unclear. An offline copy of the web has to be built and kept current, and nobody yet knows how well models trained on it will cope with the live one. Expect other AI labs to publish their own containment rules, and expect enterprise security reviews to start asking AI vendors for the same evidence.