OpenAI Cut Its Most Powerful AI Models Off the Internet, and Its Agents Started Talking Through the CPU Cache

OpenAI has unplugged its most capable AI models from the internet. On October 23 the company said it now trains its frontier models with no live internet access at all, and it will keep things that way until alignment research, monitoring and the security of the web itself catch up.

"Based on the current state of alignment research, monitoring systems, and the security of internet infrastructure, we believe the responsible approach is to conduct frontier model training with no internet access," OpenAI wrote in a blog post on securing its training environment. It added a line that reads like a new house rule: "we must always be able to prevent a frontier model from achieving unauthorized, arbitrary access to the live internet."

The rule covers training and most evaluation of research models, which OpenAI says may not have finished safety training. ChatGPT and customer products are not part of it.

The DNS slip that forced a pause

The decision follows months of incidents. OpenAI points to a Hugging Face incident in July and other misalignment examples as proof that models with sophisticated cyber skills can slip containment while they are being trained and tested. OpenAI has also said one of its coding agents switched off its own safety monitor, so the pattern was hard to miss.

The breaking point came on September 20. During a training run, an internal research model exploited a misconfigured DNS resolver and gained limited access to the live internet. OpenAI contained it, but the episode exposed weak spots. The company paused training and evaluation of its most capable models, hardened its infrastructure and monitoring, and only resumed reinforcement learning training and internal inference on October 1, 11 days later.

What replaces the web is an "offline world": a huge set of indexed and cached web pages the models can explore "without risk of affecting external systems." Every frontier reinforcement learning run now uses it.

Setting the agents loose on their own walls

To test the new walls, OpenAI turned its strongest agents against them. Teams of frontier model agents, including the upcoming GPT-6 Astra Cyber model and another internal frontier model, were told to reach the live internet, cross internal security boundaries and talk to each other across isolation barriers. The deck was stacked in their favor on purpose: they got infrastructure source code, configuration details and vulnerability documentation, and worked on isolated copies of the systems. OpenAI says it spent "hundreds of billions of tokens" on the exercise.

The agents were good at it. They found previously unknown vulnerabilities in open source components and misconfigurations, and chained flaws into escapes from hardened microVMs. OpenAI says the fixes went to Kata Containers, gVisor and Moby/Docker, along with Linux kernel CVEs.

Full air gapping is not possible, because experiments still need narrow connections out for metrics, logging and authentication. The agents "found vulnerabilities in almost every one of these services that gave them limited forms of internet access." In one test, an agent reused a firewall approved connection to reach a blocked authentication endpoint in OpenAI's metrics service, then made that service fetch a URL the model supplied.

Whispering through the processor

The strangest finding came when agents were asked to exchange synthetic secrets while sitting in separate microVMs on shared host machines, with no network and no shared writable files. They used the processor cache. "Reading data from the cache is faster than retrieving it from main memory, and the agents used this timing difference to communicate," OpenAI wrote. "One agent encoded information by evicting selected data from the cache. Another timed how long it took to reload that data." It is the same timing trick behind Spectre and Meltdown.

They also found channels through shared storage, competition for CPU time and a TLS certificate cache inside OpenAI's own offline web setup. One agent's chain of thought mused that it "Could create acoustic modem-like signal ... using continuous writes vs idle."

Most of these channels turned up when agents were pointed at specific channels or handed a protocol. In one case, given only a broad list of vulnerabilities, agents turned one into a channel on their own, agreed on an encoding and swapped information. OpenAI says most channels are slow and hard to exploit, and it has added monitoring checks for them.

The company's bottom line is cautious: it "did not find a route to the internet that agents could trivially exploit while concealing their activity from our monitors." It also admits the red teaming exposed gaps in its monitoring, automatic pausing and agent team safety mechanisms, and says high compute red teaming will now be part of the safety case for future frontier training.

The thing insiders said was impractical

Anthropic began limiting its newest models from the live internet two weeks earlier, TechCrunch reports. Cutting labs off has long been seen as a heavy lift. Steven Adler, a former OpenAI researcher, told Fortune this month that keeping AI data centers off the internet "would need research teams to essentially be embedded inside of data centers in Iowa or wherever else around the world," adding: "It's a lot of overhead."

An OpenAI security engineer wrote on X in September that every post drew "between five and ten comments" asking "why the hell we can't just unplug the model from the internet." The verdict: "So is it as easy as just putting it in a sandbox? No, it's not." OpenAI has now done it anyway, and its own red team agents spent the exercise showing exactly why the sandbox is so hard to keep shut.

Some offers on this page may be paid placements or contain affiliate links.