OpenAI Pulls Frontier Model Training Off the Live Internet

On September 20, an internal research model at OpenAI used a DNS-resolver misconfiguration to briefly reach the live internet during a training run. OpenAI paused all frontier model training and evaluation. In a post published October 23, the company said it resumed those workloads on October 1, eleven days later.

The change is blunt. Frontier reinforcement learning no longer touches the real internet. Models now train against what OpenAI calls an "offline world," described as "a vast set of indexed and cached web content" they can browse and operate against without any egress to live systems.

"We must always be able to prevent a frontier model from achieving unauthorized, arbitrary access to the live internet," the post states. That principle is now wired into the pre-run safety case: high-compute AI red-teaming is a required gate before a frontier RL job can start.

During the pause, the red-team exercise reportedly consumed roughly 400 billion tokens and surfaced around 300 high-priority issues across sandbox-escape, internal-service, and side-channel paths, including covert communication between isolated agents via CPU cache timing and disk I/O latency patterns. Anthropic made a comparable move restricting live web access about two weeks earlier, per TechCrunch. Seven researchers we follow shared the OpenAI piece the week it ran.

The post is careful about what the setup is not. OpenAI frames it as egress control plus monitoring rather than true air-gapping, and the scope is frontier training and evaluation pipelines, not ChatGPT or the public API.

Greg Brockman called the work "key to how defenders secure themselves going forward" in a post on X.