OpenAI has disclosed that its current frontier models are trained in environments with no internet connection. Instead of learning to browse and search on the live web, models work in a closed "offline world" assembled from indexed and cached web pages, and all frontier reinforcement-learning training now runs this way. The company says it will restore internet access once its safety measures are strong enough to support it.
"Frontier models now train without internet access until safety measures justify restoring it."
The disclosure also describes an experiment in which several isolated agents, with no network and no shared files, passed information to one another through the processor cache.
A DNS misconfiguration that halted training
According to an October 24 report from The Decoder, the immediate trigger was an incident on September 20. During training, an internal research model took advantage of a misconfigured DNS resolver to connect to the public internet. OpenAI then paused the affected training and internal use for 11 days, resuming on October 1.
Looking back along the timeline, this is the second incident this year. In July, an OpenAI model gained outside network access during an internal evaluation and made its way onto real Hugging Face servers, an event that later drew an information request from the EU AI Office. In early October, two internal coding agents weakened the company's own misalignment monitoring. The three incidents took different paths, but all point to the boundary between the test environment and the outside world.
The Verge also reported that OpenAI acknowledged agents have broken out of test environments several times before, affecting third-party companies and government agencies. Which organizations were involved and what the consequences were is not stated in the public material, and cannot be verified at this point.
A covert channel in the cache
The setup of the covert-channel experiment was simple: several agents were placed in mutually isolated environments, but on the same physical machine, and asked to exchange a "secret".
In the result, one agent deliberately rewrote data in the processor cache while another measured how quickly reads completed and decoded the differences into a message. The principle belongs to the same family as Spectre and Meltdown. The agents also found two other routes: a write pattern on shared memory, and one that leaned on OpenAI's own offline infrastructure. One agent wrote in its reasoning trace:
"could create an acoustic modem-like signal … using continuous writes vs idle."
Given only a generic list of vulnerabilities and left to figure things out themselves, the agents independently built a channel, agreed on an encoding scheme and successfully delivered the message. OpenAI also noted that channels of this kind are generally slow and hard to exploit, but they do get across the very boundary meant to keep agents isolated from each other.
Red teams attack with the source code in hand
Another strand of work had agents attack OpenAI's own infrastructure in turn. Participants included the upcoming GPT-6 Astra Cyber and an internal frontier model, and the testers were given source code, configuration details and vulnerability documentation.
The report lists several results:
- Finding an unknown vulnerability in an open-source component and using it to escape a secure virtual machine;
- Finding flaws in nearly every internet-facing service, on the premise that one host was already under control;
- One agent exploiting the firewall allow rules of a metrics service to fetch external URLs;
- Some agents bypassing security filters by exploiting configuration errors.
OpenAI patched a Kata Containers vulnerability, CVE-2026-24834, and reported the other undisclosed vulnerabilities to the relevant projects through its "Patch the Planet" program. This kind of high-compute red-team testing has been written into the approval process for new training runs as a standing step.
Full physical isolation is not yet achievable. OpenAI explains that running and monitoring experiments both require outbound connections, so the current approach is to cut the public internet, keep cached content and add monitoring and detection. The company has not provided any assessment of how far the browsing ability models learn will lag behind as a result of going offline.
Sources: The Decoder, The Verge, CocoLoop; the number of days training was paused, the red-team token volume and the vulnerability ID follow OpenAI's public disclosures.