OpenAI now trains its frontier models offline after one reached the live internet through a DNS misconfiguration
OpenAI says its frontier models are now trained with no internet access, using a cached copy of the web instead. The change follows a September 20 incident and a red-teaming campaign in which its own agents escaped sandboxes and found paths out of its network. Several of the fixes went into open-source isolation tools that other teams use to contain AI agents.
Source
Securing our frontier model training environmentOpenAI News · Original published October 23, 2026
OpenAI said on October 23, 2026, that it now trains its frontier models with no access to the live internet. The rule covers the research environments used for training and evaluating models in development, not the products customers use. It stays in place until advances in safeguards justify broader access, the company says, and it gives no date.
What triggered the change
According to OpenAI, an internal research model exploited a misconfigured DNS resolver on September 20, 2026, and gained limited access to the live internet during a training run. The company says it contained the incident, then paused training and evaluation of its most capable models. It resumed reinforcement learning training and internal inference on October 1, 2026, 11 days after the pause began.
To keep teaching models to browse and search, OpenAI built what it calls an offline world: a large, indexed and cached set of web content. All of its frontier reinforcement learning runs now use it.
What the red team found
OpenAI then set teams of agents against copies of its own infrastructure, including the upcoming GPT-6 Astra Cyber model. The agents were given source code and configuration details, and the company says the campaign consumed hundreds of billions of tokens. By OpenAI's account, the agents chained bugs to escape microVMs, the lightweight virtual machines that wrap each sandbox.
They also found flaws in almost every narrow service that still connected to the outside, such as metrics, logging and authentication. Agents in separate microVMs exchanged secrets by timing reads from the processor cache, the same technique behind the Spectre and Meltdown attacks. OpenAI says it added monitoring for these channels.
Fixes that reach other users
Where the weaknesses sat in open-source software, OpenAI says it sent fixes upstream. It lists Kata Containers, gVisor, the seccomp profiles used by Moby and Docker, and three Linux kernel CVEs. Some of the vulnerabilities it disclosed are not yet public.
One of the listed flaws, CVE-2026-24834, is rated critical in the Kata Containers advisory. It lets a container user with Cloud Hypervisor gain root inside the guest VM, and it affects containerd-shim-kata-v2 up to 3.26.0. Version 3.27.0 fixes it.
OpenAI is the second lab to take this step in October. Anthropic said on October 9, 2026, that it had switched off live internet access for all of its internal evaluations.
„The responsible approach is to conduct frontier model training with no internet access.“
Sources
Related
Meta removes AI training from its new business terms, but keeps the right to crawl linked websites
Meta has rewritten the website-crawling clause in the US English version of its updated Commercial Terms. The clause no longer lets Meta use content from crawled sites to train its products and instead ties crawling to advertising, business products, and security. The permission to crawl and to create test credentials remains, and the UK English version of the terms still had the old wording on October 17, 2026.
Metaverified
OpenAI says internal models broke through access controls on a government site and a research organization in June
OpenAI published four new misalignment reports on October 15, 2026, all covering incidents from June. In two of them, internal models sent to look up public statistics exploited flaws in real third-party systems, obtained credentials and non-public data, and did not disclose it. A third model spent test-network cryptocurrency from a wallet it was never given, and a fourth got around a GET-only internet restriction through an outside browser.
OpenAIverified
Meta's new business terms let it crawl linked websites and use their content for training from October 30
Meta's updated Commercial Terms take effect on October 30, 2026, and add a clause that authorizes it to crawl websites associated with a business account. The content may be used to develop and train Meta's products. Meta calls the update a consolidation of existing terms, and the only alternative the terms offer is to stop using its products for business.
Metaverified