OpenAI Is Now Keeping Its Frontier Models off the Internet During Training

Several recent incidents have involved advanced AI models from OpenAI, Google, Anthropic, and Meta getting online and breaking into outside computer systems. In response, OpenAI has made major changes to how it trains its most advanced AI models. It has cut off their access to the internet.

In an announcement, OpenAI said that internet access can help AI models learn useful skills. However, it can also “give a capable, misaligned agent opportunities to affect systems beyond our control.” This means an AI system that does not follow its intended goals could use internet access to affect systems outside the company's control.

“We’ve therefore designed the security architecture for our research environments with one overriding principle: we must always be able to prevent a frontier model from achieving unauthorized, arbitrary access to the live internet,” OpenAI said in its announcement.

OpenAI still wants its models to learn how to browse websites, search for information, and use web applications. To make this possible, it has created what it calls an “offline world.” This is a large collection of saved and organized web content that models can use without putting outside systems at risk. OpenAI says all of its frontier reinforcement learning runs now use this system.

Keeping AI agents away from the live internet is not easy. As recently as September 20, an internal research model used a mistake in a DNS resolver's setup to gain limited access to the live internet during training. This led OpenAI to pause training of its most capable models.

OpenAI is now using several additional methods to stop its models from escaping their restricted environments and reaching the open internet. It says these protections have “layers of protection that overlap and reinforce one another.”

These methods include sandboxes that limit what AI agents can access and run, small virtual machines called microVMs that keep the agents separate from the main computers hosting them, and monitoring systems that look for unauthorized activity. OpenAI also uses network and cloud security boundaries to keep the agents contained if all the other protections fail.

OpenAI did not say that these changes would last forever. Instead, it said it would keep the policy in place “until advances in these safeguards justify broader internet access.”