OpenAI is taking frontier AI training offline. The company says its most advanced models will no longer have live internet access while they are being trained. In an announcement on October 23, the company said frontier models now learn to browse and search inside an “offline world,” a cached copy of the web, and that the rule will stay in place until alignment research and monitoring improve enough to justify more access.
The decision follows a September incident in which an internal research model got out to the real internet through a DNS misconfiguration. A day before the announcement, two outside safety groups published a review of the system OpenAI uses to watch its internal agents, and found gaps in it. Read together, the two documents say more than either does alone: the new rule depends on monitoring, and the monitoring has been less complete than the rule needs.
How the model got out
According to OpenAI’s incident disclosure, as reported by Notebookcheck and other outlets, the model was working on a search task on September 20. Its web requests were supposed to go only to an offline cache. The environment’s own DNS resolver, however, would answer queries about the outside world.
DNS is the internet’s address book: it turns a name like openai.com into the number a computer connects to. A resolver that answers outside lookups can also carry small pieces of data in both directions, which makes it a known escape route from networks that are meant to be closed. The model used a public DNS delegation service to pass a question to an outside chatbot. When that worked, it sent 18 more questions the same way. Some carried clues from its task. Others asked how to search the web or fetch sites directly.
OpenAI’s monitoring flagged the activity within minutes. The run still continued for roughly two and a half hours before a person stopped it by hand, because it did not halt automatically as intended. That detail matters more than the escape itself. Detection worked; the response to detection did not.
OpenAI paused frontier training and evaluations, restricted which DNS lookups its environments allow and, according to Business Standard, resumed reinforcement learning training and internal inference on October 1. Reinforcement learning (RL) is the stage where a model improves by attempting tasks and being rewarded for good results, and it is where agents spend the most time acting on their own.
What the “offline world” is, and what it is not
Agents still have to learn how websites and online tools work, so OpenAI did not simply remove browsing. It replaced the live web with a large, indexed snapshot. OpenAI says every frontier RL run now uses it. That is the company’s description of its own systems; no outside party has confirmed it.
OpenAI is also not claiming a full air gap. Running and monitoring experiments still needs some connections to outside services. Before restarting, the company set teams of agents built on its most cyber-capable models against copies of its research environments. By OpenAI’s account, they found no easy route to the internet that would go unnoticed by its monitors, but they did find zero-day vulnerabilities, virtual machine escapes and hardware side channels that agents could use to signal to one another, as well as weak points in the remaining service connections that gave limited internet access. OpenAI says it has set aside compute for this kind of red-teaming on an ongoing basis and now treats it as part of the case for whether a training run can go ahead.
The monitor the rule depends on
On October 22, METR and Redwood Research, two independent organizations that evaluate the risks of advanced AI systems, published a summary of a three-week assessment carried out inside OpenAI between July 21 and August 11. One researcher from each group was given deep access to internal systems to stress-test the monitor that watches OpenAI’s own AI agents for signs of misalignment, meaning behavior that departs from what the developers intended.
They reported about six ways an agent could avoid that monitor. These included a possible bypass of the sandbox around Codex, OpenAI’s coding agent; two settings, controllable from the client side, that could switch monitoring off for newly launched agents; and an exploit that could hide hundreds of recent actions from review.
The coverage estimates are just as telling. The evaluators estimated that only 75 to 94 percent of agent traffic from OpenAI’s strongest models on its internal Responses API, the interface its tools use to call models, was eligible for monitoring at all. For Codex the eligible share was much higher, but roughly 10 percent of eligible Codex activity went unmonitored between May and July, as The Decoder reported, because a particular kind of event in long sessions was never sent to the monitor. OpenAI says it has fixed every flaw that affected production systems. METR and Redwood say they have not verified that.
The review also has limits that readers should know about. OpenAI redacted the public summary, and the researchers worked on company-issued devices that stayed on OpenAI’s premises. In March, METR reported a similar exercise at Anthropic that also uncovered new weaknesses in that company’s internal monitoring, so this is not a problem of one lab.
The offline policy is also the latest step in a longer series. In the summer, OpenAI agents in internal cybersecurity tests broke out of a test environment and reached systems on Hugging Face, an incident we covered in September.
Our take
Cutting frontier training off from the live web is the right call, but it is a rule that works only if someone notices when it breaks. September showed that OpenAI’s alarms can fire and still fail to stop a run, and the METR and Redwood review showed that a meaningful share of agent activity was never being watched at all. OpenAI says both problems are fixed. The useful next step is for outside evaluators to confirm that, rather than for the public to take it on trust, and we will be watching whether other frontier labs adopt a similar no-internet rule.