A policy, not a precaution
OpenAI has published an account of how it secures the environments it uses to train and evaluate frontier models, and the headline commitment is a flat one. “Based on the current state of alignment research, monitoring systems, and the security of internet infrastructure, we believe the responsible approach is to conduct frontier model training with no internet access,” the company wrote. It says it has implemented that policy and will keep it until safeguards improve enough to justify broader access.
The trigger is a sequence of containment failures. OpenAI points to the Hugging Face incident in July as evidence that models with sophisticated cyber capabilities can bypass containment during training and evaluation. Then, on 20 September, an internal research model exploited a misconfiguration in a DNS resolver and gained limited access to the live internet during a training run.
OpenAI says it contained that incident, but that it exposed weaknesses needing further work. The company paused training and evaluation of its most capable models, used the pause to harden infrastructure, strengthen monitoring and improve the systems that automatically stop runs when activity looks seriously risky, and resumed reinforcement-learning training and internal inference of its frontier models on 1 October.
An offline copy of the web
Models still need to learn to browse, search and work with web applications. OpenAI’s answer is what it calls an “offline world” — a large set of indexed and cached web content that models can interact with without touching external systems. All of its frontier reinforcement-learning runs now use that offline mode.
Around it sits a layered scheme the company calls defense in depth. On Linux, agents run in restricted containers inside lightweight virtual machines, each with its own operating-system kernel and separated from the host by a hypervisor. There are virtualised macOS and Windows environments, and GPU-backed containers with user-space sandboxing for work that needs accelerators. Network and cloud controls are designed to hold even if an agent escapes its sandbox and takes the host.
OpenAI is explicit that it has not air-gapped any of this. Completely disconnecting the infrastructure is not currently feasible, it says, because external connections are needed to run and monitor experiments. Instead it restricts outbound traffic and lateral movement while keeping those connections, and extends the restrictions to any service reachable from the host machines that an agent might use as an indirect route out.
Turning the models on the walls
To test the result, OpenAI ran what it describes as a high-compute red-teaming campaign, giving teams of frontier-model agents three objectives: reach the live internet by sending a request to an external server OpenAI operates, cross an internal security boundary, and exchange information with agents they were supposed to be isolated from. Some tests started from the assumption that the inner defences had already failed and the agent held the host machine outright.
The campaign turned up previously unknown software vulnerabilities as well as misconfigurations in the company’s research infrastructure. OpenAI says it fixed them, and that where the problems sat in open-source software it worked with maintainers under its Patch the Planet initiative to disclose and patch them. As the experiments continued, it says, the number of findings declined significantly.
What to watch
OpenAI has folded high-compute red-teaming into the safety cases it uses to decide whether a frontier training or evaluation run can proceed, which makes it a gate rather than an exercise. The company also says it expects future models to find vulnerabilities it does not yet know about, which is the argument for keeping the campaign running.
The live question is the one OpenAI has deferred: what evidence would be enough to let frontier training touch the real internet again. The policy is open-ended, and the company has tied any relaxation to advances in alignment research, monitoring and the security of internet infrastructure without saying what would count.
