OpenAI says it now trains its most capable AI models with no access to the live internet, a rule it will keep until better safeguards justify wider internet access. During training, those models now practice browsing in what it calls an offline world, a large stored collection of web pages. The company set out the rule in an Oct. 23 report on how it walls in models it is still building, which may not yet have finished their safety training. OpenAI says it tightened its defenses after earlier incidents, including one in July. On Sept. 20, an internal research model used a setup mistake in a network system to reach the internet in a limited way during a training run. OpenAI says it contained that incident.
After the Sept. 20 slip, OpenAI paused training and testing of its most capable models, strengthened its defenses and resumed training on Oct. 1, 11 days after the pause began. To test those defenses, it turned its own AI agents (AI that can carry out tasks on its own, such as using apps and websites, instead of only answering questions) against them. Each agent works in a sandbox, a walled-off computer workspace. Teams of agents were told to break out of their sandboxes, reach the internet and pass messages to agents they were meant to be kept apart from. For the test, reaching the internet meant contacting a server OpenAI set up.
The agents ran on some of OpenAI's most capable models, including GPT-6 Astra Cyber, which it has not yet released, and an internal model. To tilt the test in the attackers' favor, OpenAI gave the agents its own code, setup details and documents describing possible weaknesses, so the results don't show what the models would find on their own. It ran the tests on separate copies of its systems.
The agents found flaws nobody knew about in open-source software OpenAI uses to keep programs walled off, and OpenAI is sending fixes back to projects including Kata Containers, gVisor and Moby, the open-source project behind Docker. They also found setup mistakes in OpenAI's own services. In the tests, the agents used these weaknesses to escape their sandboxes, move between systems and reach the internet. In tests where OpenAI handed the agents control of one of the computers that run the sandboxes, they found weaknesses in almost every one of the services still allowed to reach outside, such as logging and sign-in systems, that gave them limited internet access.
Agents in separate sandboxes also found ways to pass messages without opening a network connection or changing a shared file. In most of these tests, OpenAI told the agents which channel to try or gave them a code to use. In one test, agents used the processor's cache, a small, fast memory that holds recently used data. Data in the cache loads faster than data that has to come from main memory. One agent pushed chosen data out of the cache, and another timed how long it took to reload, reading fast and slow loads as a code. OpenAI says most of these channels are slow and hard for models to use, and that it now watches for such signals.
OpenAI says it fixed what the agents found, reported the open-source flaws to the people who maintain that software, and that the agents found fewer problems as the tests went on. It says they found no route to the internet they could easily use while hiding from its monitors. It expects future models to find weaknesses it does not yet know about, and says this kind of attack testing is now part of deciding whether a big training run can go ahead. It says it has reported many other flaws that have not yet been made public.