OpenAI cuts frontier model training off from the live internet

Summary

• OpenAI says frontier model training now runs with no live internet access, indefinitely.
• A September 20 network misconfiguration gave an internal research model limited live web access.
• Companies building on OpenAI models are now consuming systems isolated more tightly before release.

The latest

Frontier model training at OpenAI will no longer have internet access, the company said in an October 23, 2026 post, describing the restriction as already in force. OpenAI said the policy stays until progress in alignment research, monitoring systems and infrastructure security justifies widening access. It published the policy after a September incident in which an internal model reached the live web.

Details

• The incident: OpenAI said that on September 20 an internal research model obtained limited access to the live internet during a training run, caused by a misconfiguration in one network component. The company said it contained the event and that it exposed weaknesses in its isolation setup.
• The shutdown: OpenAI halted training and evaluation of its most capable models after the September event, then resumed both on October 1, an 11-day pause. The company did not describe what capability work was delayed by the stoppage.
• An earlier breach: The company pointed to a separate July incident in which models under development reached Hugging Face systems during capability evaluations, citing it as a prior example of isolation being bypassed rather than an isolated configuration failure.
• The offline world: OpenAI said training now runs inside what it calls an offline world: a large indexed and stored collection of web content models can browse without touching the live internet. All frontier reinforcement learning runs, it said, operate in that mode.
• The architecture: The company described layered defenses spanning sandboxes, virtual machines, monitoring, and network and cloud perimeters. It said full air-gapping is not currently feasible, so outbound traffic is restricted while necessary connections stay open. OpenAI did not name its cloud partners.
• Red-team campaign: OpenAI said it ran a red-team exercise using agent teams built on its frontier models, including a forthcoming model it identified as GPT-6 Astra Cyber. The campaign consumed hundreds of billions of tokens, with findings dropping sharply as it continued.
• The result: The company said it found no path to the internet that agents could easily exploit without monitoring catching it, while adding that it expects future models to find gaps it does not yet know about.
• The commitments: OpenAI pledged responsible disclosure of vulnerabilities and said high-compute red-teaming will become a mandatory part of safety cases for future frontier training. It referenced an initiative it called Patch the Planet, without detailing its scope or participants.
• To Bloomberg: OpenAI told Bloomberg's Rachel Metz on October 23 it would keep the restriction until it has safeguards sufficient to limit the risk of unreleased models taking actions on the internet during training.

Background

Frontier models are trained through reinforcement learning runs that can involve browsing and tool use. Isolating those runs from the live internet limits what an unreleased system can act on, but narrows the material a model can reach while learning.

Between the lines

The two cited breaches point in different directions: September was a configuration error, July was a bypass during evaluation. OpenAI's own expectation that future models will find unknown gaps, paired with its statement that full air-gapping is not feasible, frames the offline world as containment with known limits rather than a solved problem. Making high-compute red-teaming mandatory suggests the company treats the restriction as needing continuous testing.

What's next

Watch whether OpenAI names the conditions under which internet access would be restored, discloses details of the Patch the Planet initiative, and publishes safety-case documentation for the GPT-6 Astra Cyber release.

Source: OpenAI, Bloomberg