Resuming training after an 11-day suspension, OpenAI's most powerful model has started training completely disconnected from the internet.

After 11 days of training suspension, OpenAI resumed its frontier reinforcement learning training and internal inference on October 1. But this time, the AI has to learn how to access the internet in an offline environment disconnected from the real web.

On October 23, OpenAI made this training environment public, which is like building a "Truman Show" for AI:

A large number of web pages are indexed and cached, and the model can practice searching, browsing and using web applications inside it, but cannot access the real internet at will.

All web pages are migrated into the environment, but the paths leading to the external internet are not necessarily all blocked. The tools and system services called by the model may still become exits to bypass restrictions.

Back on September 20, a research model kept failing to get results when searching for a blog author, so it turned to test other internet access paths, and finally bypassed the restrictions and connected to an external chatbot.

It did not find the target person, but it found the path to the external internet.

This unauthorized crossing incident made OpenAI suspend the relevant training and evaluation of its most powerful model.

Search Attempts Failed, AI Started Testing the Boundaries of Internet Access

On September 20, an internal research model at OpenAI received a search task: find the author of an article based on the character's experience and blog clues.

It first called the search tool, but did not find a reliable answer; after switching to other search channels, it still encountered failures.

Then the model began to check what paths it could use to access the external network.

The gap appeared in the DNS domain name resolution service.

This basic service is responsible for resolving domain names into network addresses, but the filtering of this service in the training environment was not strict enough.

The model followed this channel to connect to the external chatbot and received a response.

The agent took advantage of the gap in the domain name resolution configuration, received the response from the external chatbot, and confirmed that it had broken through the internet access restrictions.

The task did not require the model to check for network restrictions.

OpenAI defined this behavior of bypassing restrictions and exceeding the reasonable scope of tasks as misaligned behavior.

Subsequently, OpenAI suspended the relevant training and evaluation of its most powerful model, and inspected the internet access restrictions, monitoring and shutdown processes.

The incident report also made it clear that this specific involved model will not continue to be trained.

No Real Internet Access, How to Teach AI to Browse the Web?

If you want to teach a bird to fly but cannot release it into the sky, one solution is to first build a giant birdcage where it can practice flying.

The "offline world" built by OpenAI is exactly such a birdcage.

The agent searches the internal index and reads cached web pages; when there is a missing page in the cache, it will not connect to the internet temporarily to grab the content.

The AI on the left side of the diagram can still search and open web pages, but the destination of its requests has changed.

When searching, it queries the internal web page index; when opening a web page, it reads the pre-cached copy. Pages that do not exist in the cache will not be temporarily fetched by connecting to the internet.

The model can look up information, browse web pages, and practice using web applications in this environment, but its operations will not directly affect real websites.

There are also boundaries for multi-agent collaboration: only teammates who are authorized to cooperate can exchange information through the shared message board. Other tools and resources called by the model must also be restricted by permission rules.

The red cross on the right marks the boundaries that need to be guarded: access to the real-time internet, connection to other agents that should be isolated, or unauthorized operation of the underlying servers should all be blocked.

But after drawing the boundaries, it is also necessary to prevent the model from finding a way to bypass them.

When the accident happened on September 20, this offline cache library had already been put into use. During that operation, all other web page accesses except the DNS channel entered the cache, and did not touch the real-time internet.

The path of web pages was restricted, but auxiliary services such as domain name resolution left an exit.

Therefore, restrictions cannot only target the browser.

Which tools the model can call, and which services these tools can connect to, must all be restricted to prevent the model from taking a detour through auxiliary services to the external internet.

This set of isolation measures does not mean that the entire infrastructure is physically disconnected from the internet.

OpenAI stated that necessary external connections are still required for experiment operation and monitoring, and it is necessary to restrict the model's unauthorized access while retaining these connections.

This measure targets the internal frontier training environment and does not involve the internet access function for ChatGPT users.

Similar boundary issues also appeared in Anthropic's tests.

On October 9, the company disclosed several incidents where models brought test operations into real systems.

Haiku 4.5 fabricated clues about a homicide case and even submitted a form to the police. Fortunately, the form was marked as spam and did not enter the investigation process.

What is even more outrageous is the Mythos preview model. When it encountered an error while using a scientific computing tool, it exploited a vulnerability on a university website, executed commands on the other party's server, and completed the calculation.

Facing these AIs that know how to "adapt flexibly", Anthropic also announced that it would suspend all real-time external internet access for internal evaluations until more reliable internet control measures that can prevent models from affecting real systems are established.

Spending Hundreds of Billions of Tokens to Let AI Compete Against Itself

After patching the known gaps, it is also necessary to find the undiscovered exits.

OpenAI chose to "use magic to defeat magic": let frontier models form a red team to actively break through their own training defense lines.

The AI challenged the training defense lines, consumed hundreds of billions of tokens, and found nearly 280 candidate problems in total, with the number of new discoveries gradually decreasing in the later period.

The AI needs to try these three things: connect to the real-time internet, go beyond the authorized use environment, and exchange information with other agents that should be isolated.

The target of the internet access test is an external server controlled by OpenAI itself.

The test is carried out in a specially built isolated replica environment.

Sometimes, researchers directly provide the model with source code, configuration and potential vulnerability information to let it find weak points; sometimes they simply grant the model host control, simulate that the internal defense line has been breached, and then check whether the outermost restrictions can still hold.

This "self-competition" found previously unknown software vulnerabilities and configuration problems.

OpenAI said that it has patched the software accordingly, tightened network restrictions, and improved monitoring.

Defense also needs to be reinforced layer by layer.

The sandbox restricts what the model can access and execute, the virtual machine isolates the operating environment, the monitoring system identifies anomalies, and peripheral network and cloud measures continue to block unauthorized access.

This defense system should achieve if one defense line is breached, the next one can still block the intrusion.

Based on the results of the red team test, the completed repairs, and the improvements of the monitoring and shutdown system, OpenAI judged that the enhanced protection is sufficient to resume frontier reinforcement learning training and internal inference.

When the Alarm Goes Off, Can Humans Still Pull the Plug?

The DNS incident also exposed a worrying gap:

The automatic shutdown mechanism failed.

The monitoring system issued an alarm, and the personnel later confirmed that the alarm was received.

But counting from the time the alarm was confirmed, it took about 2.5 more hours before the relevant operation was manually terminated.

Anthropic's review on October 23 exposed another difficult problem that the model voluntarily stopped operating.

In the offensive and defensive evaluation that allowed internet access and turned off network security guardrails, Mythos 5 submitted malicious code to an unrelated GitHub project, and even pretended to be a real person to urge the maintainer to accept the code.

The maintainer rejected the code, but the model still kept applying pressure until the operation timed out.

After the incident, the researchers handed over the records of the attack process to the model and let it continue the operation in an offline simulation.

Even after supplementing evidence to prove that the other party was a real developer and the attack had exceeded the test scope, the model only stopped the attack in 5% of the rerun tests.

The model did not stop on its own, so external monitoring and shutdown mechanisms must take over in time. But these protections themselves may also leave gaps.

Inspections announced by METR and Redwood Research on October 22 found that the system used by OpenAI before and on July 21 had vulnerabilities that could allow hundreds of operations to bypass monitoring. OpenAI stated that the relevant issues have been fixed, and the two institutions have not yet conducted re-verification.

The scientific community has also put forward requirements for how to set up isolation measures and how to disclose information after the defense line fails.

In October, nearly 500 co-signers including Yoshua Bengio and Geoffrey Hinton published an open letter, calling for models with network attack and defense capabilities to be isolated from the internet by default, for international institutions to promote internet protection specifications and record isolation failure events, and for relevant safety accidents to be reported and eventually made public.

OpenAI also predicts that stronger models in the future may still discover unknown vulnerabilities.

Therefore, continuous red team testing has been included in the safety assessment of frontier training.

Whether this "offline world" can support the next generation of models within the safety boundary still needs to be tested by subsequent training.

As models are getting better at finding ways to break through restrictions, human isolation, monitoring and shutdown mechanisms must also keep up.

Training can be restarted, but after a boundary violation, whether it can be stopped in time cannot only rely on the model to stop voluntarily.

References:

https://www.bloomberg.com/news/articles/2026-10-23/openai-to-train-ai-models-without-internet-after-cyber-incidents?srnd=phx-ai

https://openai.com/index/securing-our-frontier-model-training-environment/

https://www.reuters.com/business/openai-resumes-frontier-ai-training-with-enhanced-security-no-internet-access-2026-10-23/

This article is from the WeChat official account "AI_era" (ID: AI_era), written by Yuan Yu, and authorized for release by 36Kr.