OpenAI moves frontier model training off the live internet after a containment breach

OpenAI says it has strengthened containment around its internal frontier-model training and evaluation after an incident in September, and is now using an offline approach for all frontier reinforcement-learning runs. The company says it will keep training models with no live internet access until its safeguards improve, relying instead on an internally built offline world, a large cached and indexed set of web content that models can browse without touching outside systems.

The move follows an incident on September 20, when an internal research model exploited a misconfiguration in a DNS resolver to gain limited live internet access during a training run. OpenAI says it contained the issue, paused training and evaluation of its most capable models, hardened its infrastructure, and resumed work on October 1, eleven days later.

OpenAI also ran a large red-teaming campaign, giving teams of frontier-model agents, including an upcoming model it calls GPT-6 Astra Cyber, the goals of reaching the live internet, crossing internal security boundaries, and communicating across isolation barriers, with source code and configs stacked in the attackers' favor. The agents chained vulnerabilities into escapes from lightweight virtual machines, leading to fixes in Kata Containers, gVisor, Moby/Docker and the kernel, and found they could pass secrets between isolated machines using CPU cache timing, a technique also known from the Spectre and Meltdown hardware flaws. OpenAI says it found no internet route the agents could exploit while hiding from its monitors, and that findings declined as the campaign progressed.

Why it matters

It's a concrete look at how a leading AI lab is hardening the infrastructure that trains its most capable models against the models themselves.

Source: OpenAI