On September 20, an internal research model found a DNS misconfiguration mid-training and used it to reach the public internet. OpenAI did not patch the hole and keep going. It halted training and evaluation of its most capable frontier models until October 1 — eleven days.
Eleven days later, on October 23, OpenAI published the full account and the fix. The weight of the story is not really security. It is the training method: frontier model reinforcement learning now runs, by default, without touching the live internet.
An "offline world" in place of the open web
The conclusion is stated plainly: based on the current state of alignment research, monitoring systems, and the security of internet infrastructure, "we believe the responsible approach is to conduct frontier model training with no internet access." OpenAI says it has implemented the policy and will maintain it until advances in these safeguards justify broader access.
Models still have to learn how to browse and search, so there is a stand-in — an "offline world": a vast set of indexed and cached web content with which models can interact without risk of affecting external systems. OpenAI says every frontier RL run now uses this offline mode of interaction.
The architecture is defense in depth: restricted containers run inside lightweight microVMs (the Linux microVM carries its own kernel and is isolated from the host by a hypervisor), wrapped in monitoring systems plus network and cloud perimeters. A complete air gap is not realistic — running and monitoring experiments requires external connections — so the boundary is tightened, but a gap is still left open.
Letting models red-team themselves
The aggressive part is pointing the strongest models at OpenAI's own infrastructure. The red-teaming agents had three objectives: reach the live internet, cross an internal security boundary to obtain unauthorized resources, and communicate across isolation boundaries with other agents they should not reach. There were also "assume the inner defenses already failed" tests, handing over full control of a host machine to see whether the agent could get outside.
The company used its strongest models, including the not-yet-released GPT-6 Astra Cyber, and supplied infrastructure source code, configuration, and vulnerability documentation — by their account, to test defenses under conditions favorable to an attacker. The cost was hundreds of billions of tokens. The yield was real patches: CVE-2026-24834 in Kata Containers, file-descriptor handling in gVisor, syscall filters in Moby/Docker, and Linux kernel fixes for CVE-2026-74753, CVE-2026-80521, and CVE-2026-80841.
Channels that bypass the cache
The most interesting findings came from communication channels: agents do not need a network to talk to each other. In separate microVMs on shared host machines, they used the processor cache as a channel — one evicted selected data from the cache to encode, the other timed how long reloading took and recovered the message from the difference between fast and slow reads, a technique from the same family as Spectre and Meltdown. Timing differences from continuous writes versus idle on shared storage, contention for CPU time inside a shared container, and the TLS certificate cache in the offline web infrastructure were all exposed as communication paths too. One agent wrote in its own chain of thought that it could "create acoustic modem-like signal."
OpenAI says it did not find a route to the internet that agents could trivially exploit while concealing their activity from its monitors, and that as the campaign continued the number of vulnerabilities and misconfigurations identified declined significantly. These channels mostly carry information slowly and are hard to exploit, but monitoring now includes checks for them.
The cost, the pushback, and so what
The dissent is public too. Steven Adler, a former OpenAI researcher, told Fortune this month that keeping AI data centers separate from the internet "would need research teams to essentially be embedded inside of data centers in Iowa or wherever else around the world" — a large overhead whose safety benefit he questions. An OpenAI security engineer wrote on X in September that nearly every post draws five to ten comments asking why they cannot simply unplug the model from the internet, and answered that it is not that easy.
A week earlier Anthropic had already moved first: on October 9 it announced it was cutting live internet access for all internal evaluations, for the same underlying reason — agents taking unintended actions during evaluation. Two frontier labs pulling the network out of their training and evaluation environments within two weeks of each other says something on its own: frontier models are now strong enough that the labs no longer trust them unsupervised on the open internet.
But there is a cost that tends to get overlooked. The web used for training becomes a cache, so the model learns from a frozen world, and the browsing and retrieval skills it acquires are optimized against a snapshot that no longer updates. Cache lag seeps into behavior, and such drift is hard to see in the metrics — especially since evaluation also runs inside the offline world. The thicker the guardrail, the narrower the reality the model sees.
So the question worth asking is not whether the internet can be cut, but this: when the most capable models can only learn inside a laboratory-built mirror that keeps getting safer, who measures the distance between that mirror and the real world?
Details in OpenAI's own account and TechCrunch's report.