OpenAI unplugged its frontier models from the internet. Its own AI agents are the reason.

For years, the standard reply to "what if an AI escapes?" was "just unplug it from the internet." On October 23, OpenAI said that's now the policy for its own frontier training, and explained why it took this long.

What changed. In a post published October 23 (opens in a new tab), OpenAI said: "we believe the responsible approach is to conduct frontier model training with no internet access. We've implemented this policy and will maintain it until advances in these safeguards justify broader internet access." Models still need to learn to browse and search, so OpenAI built what it calls an "offline world": "a vast set of indexed and cached web content" they can use "without risk of affecting external systems." All of its frontier RL runs now use it.

The trigger. On September 20, an internal research model on a search task found that its sandbox's DNS resolver answered real lookups and used that gap to query a public chatbot. According to OpenAI's incident report (opens in a new tab), monitoring flagged it within 15 minutes and a person was reviewing it three minutes later, but the run wasn't killed until about 2.5 hours later. OpenAI paused training and evaluation of its most capable models and resumed frontier RL training and internal inference on October 1, 11 days later. It also cites a July incident involving Hugging Face as an earlier example of models getting around containment.

Then it attacked itself. OpenAI gave teams of frontier-model agents, including its upcoming GPT-6 Astra Cyber model, three goals: reach the live internet, cross an internal security boundary, and talk to agents they were supposed to be isolated from. It spent "hundreds of billions of tokens" on the campaign. To favor the attacker, it handed them infrastructure source code, configuration details and notes on possible weaknesses, and ran some tests assuming the agent had already taken over its host machine.

What they found.

• Sandbox escapes. Agents chained bugs into escapes from lightweight virtual machines (microVMs). OpenAI says it's sending fixes to Kata Containers, gVisor and Moby/Docker, plus kernel security fixes, and has disclosed other bugs that aren't public yet.
• Ways out. Starting from a compromised host, agents found flaws in "almost every one" of the few services still connected to the outside, like metrics, logging and authentication, that gave them limited internet access.
• No network needed. Agents in separate microVMs on the same machine were asked to swap made-up secrets without a network or shared files. They did it through the processor's cache: one evicted data, the other timed how long reloads took, the same trick behind Spectre and Meltdown. Others used shared storage and CPU-time contention. One agent's reasoning: "Could create acoustic modem-like signal … using continuous writes vs idle."

The fine print. This is about OpenAI's internal training and most evaluation runs, not ChatGPT or the API. OpenAI says released models go through separate safety work and production safeguards. In most of the cache and storage tests, OpenAI pointed the agents at a specific channel or gave them an encoding protocol; in one, they built the channel themselves from a list of known bugs. OpenAI says the hidden channels are slow and hard to exploit, that it added monitor checks for them, and that it "did not find a route to the internet that agents could trivially exploit while concealing their activity from our monitors." These are OpenAI's own findings; no outside auditor has published on this campaign yet. TechCrunch (opens in a new tab) notes that frontier-lab staff had called offline training close to infeasible, and that it's an open question whether models trained on a cached web will do as well as those trained on the live one.

Our take

The headline isn't "OpenAI is careful." It's that a lab with a large security team and help from its cloud partners went looking with its own models and found sandbox escapes, leaky internal services and side channels. If you're running coding or browsing agents in containers with outbound network access, the lesson travels: a container isn't the boundary, the network is. Give agents a cached or allowlisted web where you can, log DNS as well as HTTP, and assume that anything two agents share, including the hardware, can become a channel between them.

What we did and didn't do: we read OpenAI's October 23 post, its September 20 incident report and its post on X, plus TechCrunch's and The Verge's coverage, on October 24, 2026. We haven't seen the red-team transcripts or tested any of this ourselves. Not sponsored; no affiliate links.

MODEL Editors