No Access to Live Internet: OpenAI Keeps Frontier AI Models Offline After Security Breaches

OpenAI has decided to keep its most advanced AI models offline while they are being trained. This follows tests in which increasingly capable models found ways around security controls and reached the live internet.

OpenAI says its latest security tests, which used large amounts of computing power, found weaknesses and incorrect settings that could let AI agents go beyond the limits set for them. These results strengthened the company's decision to block direct internet access while improving the systems that keep its most advanced models contained.

An AI Model Crossed the Internet Boundary

OpenAI said it made this decision after both real incidents and extensive tests designed to challenge its security systems.

The company said in its blog post: "As models become more capable, they become better at finding ways around those limits. A powerful model might use a software bug or incorrect setting to escape a sandbox, take advantage of an internal service to reach the live internet, or find unauthorized ways to communicate with agents in other sandboxes. The Hugging Face incident in July, along with other cases of models behaving in ways that do not match their intended goals that we have observed, shows that models with advanced cybersecurity skills can get past security controls during training and testing."

On September 20, an internal research model used an incorrect setting in a DNS resolver to gain limited access to the live internet during a training session.

The company stopped the incident from spreading. However, OpenAI said it revealed serious weaknesses that led the company to pause training and testing of its most capable models.

Based on the current state of research into AI alignment, monitoring systems, and internet security, we believe the responsible approach is to train our most advanced models without internet access.

During the pause, OpenAI improved its security systems, strengthened monitoring and upgraded tools that can automatically stop training when an activity creates a serious risk.

The company restarted reinforcement learning training and internal model use on October 1, 11 days after the pause began.

Instead of giving models unrestricted internet access, OpenAI has built an "offline world." This is a large collection of web content that has been saved and organized so models can browse, search and use online information without directly accessing outside systems.

OpenAI says all its training runs for advanced models that use reinforcement learning now operate in this offline mode.

OpenAI Asked AI Agents to Find Ways Out to the Internet

To test whether its security systems could withstand more capable models, OpenAI used agents powered by its most advanced models to attack its own research systems. The agents were told to reach an outside server, cross internal security boundaries and communicate with other agents they were supposed to be unable to contact.

The campaign used hundreds of billions of tokens and found software weaknesses that had not been known before, as well as incorrect settings in the company's systems.

OpenAI said some of the discoveries allowed agents to escape sandboxes, move between systems and reach the live internet.

In one test, agents took advantage of weaknesses in limited connections that remained open for services such as performance measurement, logging and authentication.

One attack reused a connection allowed by the firewall to reach an authentication endpoint that should have been blocked. The agent then made the service retrieve a web address chosen by the model. Other tests took advantage of incorrect DNS and firewall settings, along with services that could retrieve information from outside web addresses.

Blocking Internet Access Is Only One Layer of Protection

OpenAI says keeping models offline is one part of a wider security plan called "defense in depth." Its systems combine sandboxes, small virtual machines, monitoring tools, and network and cloud controls. These layers are designed to stop one security failure from automatically turning into a full system breach.

The agents running the security tests also found ways to escape micro virtual machines, or microVMs, and run code on the host computers. OpenAI said it fixed weaknesses in parts of its systems, including Kata Containers, gVisor and Moby/Docker. It is also working on more fixes to operating system kernels and reporting security weaknesses that have not yet been made public.

The models also found ways to communicate between environments that were supposed to be isolated, even without using normal network connections.

In one experiment, agents used tiny differences in processor cache timing to send artificial secret information between separate microVMs. Other tests found ways to communicate through shared storage, CPU usage and a cache used for TLS certificates.

OpenAI said the tests did not find an internet access route that agents could easily use while also hiding their actions from monitoring systems. Even so, the results led to software fixes, tighter limits and stronger monitoring.

The company now considers ongoing security tests using large amounts of computing power a key part of the safety checks for future training and testing of its most advanced models.

Still, the work of making our systems more secure is never finished.

OpenAI said it will continue checking code and cloud settings for weaknesses, testing monitoring tools and automatic shutdown systems, working with cloud providers, and setting aside substantial computing power to keep testing attacks against its own sandbox and network protections.