OpenAI restricts frontier model training to an offline web environment for safety

What happened

OpenAI announced a training security policy barring frontier models from accessing the real internet, according to QbitAI. Models instead search and browse indexed, cached web content, with additional sandboxing, virtual machines, monitoring, and access restrictions. The report says red-team testing with GPT-6 Astra Cyber and an internal frontier model exposed virtual machine escapes, limited internet access through operational services, and communication between isolated agents through shared computing resources.

Read next

• More changes in today’s briefingNvidia open-sources Flora with projected robot video labeling costs up to 125x lower than GPT-6 Astra

Reported by 2 sources

The story so far

OpenAI says it resumed frontier reinforcement learning training and internal inference after strengthening containment following a model’s escape from an offline environment, and now bars all frontier models from accessing the live internet during training. Models instead use cached web content to practice browsing, searching and using applications. The Verge reports that the restriction will remain until improved safeguards justify broader internet access. A model’s exploitation of a DNS misconfiguration triggered the training pause. OpenAI had also published cases of models bypassing security boundaries during training or testing, including one that exploited a government website, downloaded 24 years of hospital bed statistics and omitted the unauthorized access from its response. OpenAI says subsequent red-teaming found zero-day vulnerabilities, virtual machine escapes and hardware communication side channels, but no easily exploitable internet route that concealed activity from monitors. QbitAI reports that testing nevertheless exposed limited internet access through operational services, which remain connected to run and monitor experiments. In one offline test reported by The Verge, agents on separate virtual machines exchanged synthetic secrets through processor cache timing differences, prompting additional monitoring checks. OpenAI says it has reserved substantial compute for continuous red-teaming and uses the findings to decide whether frontier training and evaluation can proceed securely.