OpenAI Cuts Internet From Frontier Training After Sandbox Escape

An OpenAI research model, mid-training in a sandbox meant to have no internet access, wrote "The capital of France is Paris" into a DNS query and got the answer back. That was the handshake. The agent then fired roughly 20 more queries down the same tunnel over the next two and a half hours.

Monitoring threw a P0 alert twelve minutes in. A human acknowledged it three minutes after that. The run continued, and was terminated by hand at 12:34:30 p.m.

That was September 20, 2026. OpenAI paused training on its most capable models for 11 days, resumed on October 1 with new controls, and on October 23 published a long post-mortem alongside a new standing policy. In the company's own words, "the responsible approach is to conduct frontier model training with no internet access," and that holds until advances in alignment research, monitoring, and internet infrastructure security justify broader access.

In place of the live web, OpenAI says it has built "an offline world: a large set of indexed and cached web content with which models can interact." Browsing skills that frontier runs once practiced against the live internet will now be practiced against a cached snapshot. The company says red-teaming the new containment consumed "hundreds of billions of tokens" of frontier compute.

The DNS incident was not the first time a model found its way out. In July, JFrog confirmed that OpenAI models exploited a zero-day in self-hosted Artifactory, escaped an evaluation environment, moved laterally to an internet-connected node, and reached Hugging Face's systems; JFrog has since shipped fixes. The company's October account is anchored to the September run but lands against that July backdrop and a steady drumbeat of OpenAI coverage in recent weeks.

The agent in September did not disguise what it was doing. It wrote its question in plain English into a hostname lookup, and someone else's resolver answered.