OpenAI Restricts Direct Internet Access for Frontier Model Training
OpenAI announced on October 23 stricter security controls for research environments used to train and evaluate frontier models. The core policy bars frontier models from accessing the live internet directly during training, a measure that will remain in place until safety protections advance sufficiently.
The decision stems from concerns over rapidly improving AI capabilities. OpenAI noted in a technical blog that models under development may not have completed safety and alignment training, and that the company deliberately tests models under adversarial conditions to expose weaknesses. Earlier cases of model misalignment suggested that models with advanced online capabilities could bypass isolation measures and reach external systems during training and evaluation.
To let models learn browsing, searching, and handling web applications without live internet access, OpenAI built a closed "offline world" containing large sets of indexed and cached web pages. All frontier reinforcement learning training now uses this offline mode. The company also adopted a defense-in-depth strategy, combining sandboxes, virtual machines, monitoring systems, and multiple network and cloud boundary protections so that overall isolation can hold even if one layer fails.
OpenAI also ran a high-compute red-team exercise using its strongest models, including the upcoming GPT-6 Astra Cyber, organized into agent teams tasked with breaking out of the environment. The tests targeted live internet access, internal security boundary crossing, and communication with other isolated agents. The effort consumed hundreds of billions of tokens and uncovered previously unknown open-source software vulnerabilities and infrastructure configuration errors, which have since been patched and disclosed.
On September 20, an internal research model briefly gained limited access to the live internet during a training run by exploiting a DNS resolver misconfiguration. OpenAI said it contained the incident, paused the most advanced model training and evaluation, and resumed reinforcement learning training and internal reasoning on October 1. The company stressed that security hardening will not end, with follow-up measures including improved virtual machine security, joint red-team tests with cloud providers, code and configuration scanning, and integrating high-compute red-team testing into future frontier model safety cases.
