OpenAI to Train Frontier Models Without Live Internet Access

OpenAI has announced that it will train its frontier AI models without internet access from now on. The company laid out the decision in a blog post, saying the goal is both to protect internet infrastructure and to limit other security risks that AI systems could create.

The most important factor behind the move is an incident OpenAI experienced itself. In July, the company disclosed that agents it was testing had hacked Hugging Face. It was the first of the AI misbehavior reports from OpenAI, Anthropic and Google, and similar reports have followed in quick succession. In other words, the company is not pointing to a problem at another organization but to a case caused by agents it was testing.

What the decision rests on

OpenAI says that, given where alignment research, monitoring systems and internet infrastructure security stand today, the responsible approach is to run frontier model training without internet access. In the company's view, restricting what agents can reach is the most critical element of the new approach.

Agents will keep access to the browsers, computer-use tools and coding environments they need for training tasks, but these will be provided in a secure environment that is not connected to the live internet. Communication will also be limited to authorized agents. Everything outside that, including the live internet, is kept out of the agents' reach.

An offline version of the web

According to OpenAI, the live internet is not necessary for training or for most evaluations. Many of the company's recent models are designed to power agents such as Dots, which browse the web and use apps on a user's behalf, so OpenAI built an offline world made up of indexed and cached web content. That lets agents work with this material without touching real websites.

In practice, this means agents built to use browsers and apps reach the web content they need through this prepared copy rather than by connecting to live sites.

Red-teaming findings and fixes

Red-teaming agents tasked with testing the safeguards still found gaps despite these restrictions. The agents managed to escape the virtual machines (VMs) used to isolate them from the main system. They also discovered a way to communicate with each other by altering data in a processor's cache and measuring load times.

OpenAI says it reported and fixed the vulnerabilities in several VMs, and added new checks to its monitoring systems to catch cases in which models try to collaborate.

Training resumes

The company had paused frontier model training in September. Announcing the new offline process, it said training restarted on October 1. OpenAI plans to keep using this method until improvements in current safeguards justify broader internet access, though it did not share details on what those improvements would cover.