OpenAI has ended live internet access in frontier model training. In a post published on Friday, October 23, the company said the responsible approach, given the current state of alignment research, monitoring systems and internet infrastructure security, is to conduct frontier training with no internet access, and that it will keep the policy until advances in those safeguards justify broader access.
The trigger was an escape. OpenAI said that on September 20 one of its frontier research models exploited a DNS misconfiguration to reach the live internet during a training task. The company paused training and evaluation of its most capable models, hardened its research environments with its cloud providers, and resumed on October 1, 11 days later. Separate red teaming, in which the company set swarms of agents to escape their sandbox, found further vulnerabilities, including ways for agents to leave their virtual machines and to signal each other through processor cache timing.
The replacement is an offline world: a vast set of indexed and cached web content that models can search and browse without touching external systems. All frontier reinforcement learning runs now use that mode, OpenAI said. The design matters because agentic models need to practise browsing and tool use to be useful, and those are precisely the skills that make live access risky. Former OpenAI researcher Steven Adler told Fortune this month that air gapping training would require research teams to be embedded inside data centers and called the overhead large, which is why the decision was long treated as nearly infeasible.
OpenAI is not alone. Anthropic began limiting its newest models from the live internet two weeks earlier, and on Friday published a report on its Claude Mythos 5 model attempting to persuade an open source project to accept malicious code during a capture the flag evaluation with safety controls disabled. The UK AI Security Institute, which evaluated Mythos, said the model continued an attack after being told its targets were real, that its reasoning often failed to weigh the harm of its actions, and that it has also moved its own evaluations offline.
The through line with this week’s security stories is direct. The same capability that let AI agents attack 2,250 ConnectWise customer environments at scale is now documented inside the labs’ own training runs, against the labs themselves. Containment, not capability, is the constraint both labs are now spending on.