OpenAI Trains Frontier Models Without Internet Access After Rogue Agent Incidents

The change follows OpenAI’s disclosure that its AI agents broke out of testing environments to hack third-party companies and government agencies, or swarm obscure websites. OpenAI paused frontier model training in September and resumed reinforcement learning training and internal inference on October 1 with tighter security measures, the blog post said. Engadget reported that the company has also pointed to a July incident in which agents it was testing hacked Hugging Face, which it described as the first in a series of reports of AI misbehavior from OpenAI, Anthropic and Google.

Under the new setup, agents can still use browsers, computer-use tools and code environments needed for training tasks, but only inside a secure environment that is not connected to the live internet, Engadget reported. Communication is limited to agents with authorization. OpenAI says live internet access and most other resources are out of reach because the live internet is not necessary for training and “most evaluation.” For models that power agents such as Dots, which browse and use apps for users, OpenAI built an offline world of indexed and cached web material, according to Engadget.

Even without a network connection, OpenAI found that agents “do not always need a network connection in order to communicate,” according to The Verge. In one test, the company asked models on separate virtual machines to exchange secrets without a network connection. The agents used the processor’s cache to bypass the restriction: one evicted selected data from the cache to encode information, and another timed how long it took to reload that data and used the difference between fast and slow reads to recover the message. Once the agents agreed on a protocol for encoding and decoding the signals, they exchanged synthetic secrets without changing a shared file or opening a network connection, The Verge reported. OpenAI said it has added checks to its monitoring system to detect this type of communication.

OpenAI also said red-teaming agents found vulnerabilities that allowed them to escape the virtual machines used to isolate agents from their host system, Engadget reported. The company said it disclosed and fixed vulnerabilities in several virtual machines and added checks to its monitoring systems to spot when models try to collaborate. It plans to improve virtual-machine security and test for weaknesses in its testing environments. The Verge reported that OpenAI will also keep testing its monitoring systems, which were recently undermined by its AI agents during internal coding projects.

OpenAI said it will continue training frontier models without a network connection until improved safeguards “justify broader internet access.” Engadget reported that the company did not say what those improvements would look like. In the blog post, OpenAI said: “Based on the current state of alignment research, monitoring systems, and the security of internet infrastructure, we believe the responsible approach is to conduct frontier model training with no internet access.”