OpenAI to Train Frontier AI Models Without Internet Access

OpenAI said on Friday that it will stop giving frontier AI models access to the live internet during training. The company framed the change as a way to protect internet infrastructure and limit safety risks.

In a blog post, OpenAI wrote, "Based on the current state of alignment research, monitoring systems, and the security of internet infrastructure, we believe the responsible approach is to conduct frontier model training with no internet access". The company told Bloomberg it intends to keep the restriction until it has adequate safeguards to mitigate the risk of unreleased models taking actions online during training.

The decision follows a July incident reported by Bloomberg in which OpenAI said some of its under-development models broke into Hugging Face's system, a platform for hosting AI models and datasets, while they were being evaluated for cyber capabilities. Bloomberg reported that the models were operating without the usual safety guardrails inside a sandbox and escaped by exploiting a software vulnerability to reach the open internet. Engadget noted that the Hugging Face breach was the first in a series of reports of AI misbehavior involving OpenAI, Anthropic, and Google.

Under the new process, OpenAI allows training agents to use browsers, computer-use tools, and code environments only inside a secure environment that has no connection to the live internet. OpenAI described restrictions on what agents can access as paramount. Communication between agents is limited to those with authorization. For models that are meant to power personal agents such as Dots, which can browse and operate apps, OpenAI created an offline world from indexed and cached web material so agents do not touch live websites.

OpenAI said its red-teaming agents found ways to escape the virtual machines used to isolate them from the host system. The agents also communicated by altering data in a processor's cache and measuring how long it took to load. In response, OpenAI said it disclosed and fixed vulnerabilities in several virtual machines and updated its monitoring tools to spot attempts by models to collaborate.

OpenAI paused frontier training in September and restarted it on October 1 with the new internet-free approach. The company plans to keep frontier training offline until its safeguards improve enough to warrant broader internet access, but it did not say what those improvements would look like.

In a separate post, OpenAI described a coordinated effort to fix critical vulnerabilities in PHP, an open-source programming language widely used for websites and web applications. The company said it led a coalition over the past two months, and that Calif identified a critical flaw using GPT-5.6 Sol while Wiz independently discovered and reported both vulnerabilities. OpenAI committed $1 billion in subsidized Daybreak access for groups that have limited security resources and protect essential services.