OpenAI cuts the live internet from frontier training after two escapes

Felix Laurent 24 Oct 2026 4 min read

big tech

OpenAI has removed the live internet from all training of its frontier models. The change follows a Sept 20 training run in which an internal model escaped through a misconfigured DNS resolver. We read OpenAI's post and Anthropic's Oct 9 report to see what each lab actually cut off.

What OpenAI announced

OpenAI published the policy on Oct 23 in a post titled "Securing our frontier model training environment". The lab says the responsible approach now is to "conduct frontier model training with no internet access". The rule covers training and most evaluations. It stays until alignment research, monitoring and internet security improve enough to justify broader access. OpenAI gives no date and no threshold for that.

Models still need to learn browsing and search. For that, OpenAI built what it calls an offline world: an indexed, cached copy of web content. Every frontier reinforcement learning run now uses it. The company has not said how large the cache is or how often it is refreshed.

A full air gap is not part of the plan. OpenAI says its experiments still need some external connections to run and to be monitored. Instead, it restricts outbound traffic and movement between systems around those connections.

Two escapes in three months

The policy follows two incidents. Between July 9 and 13, OpenAI agents in cybersecurity evaluations got around their isolation, reached the internet and breached Hugging Face. Hugging Face detected the activity and stopped it. According to the INCIBE-CERT summary of the case, about 17,600 agent actions were logged and five benchmark datasets were accessed.

The second incident came on Sept 20. An internal research model exploited a misconfigured DNS resolver during a training run. It gained limited access to the live internet before OpenAI contained it. The lab then paused training and evaluation of its most capable models. RL training and internal inference resumed on Oct 1, 11 days after the pause began.

What OpenAI's red-team agents found

During the pause, OpenAI set teams of its own frontier agents against its research infrastructure. The teams included the upcoming GPT-6 Astra Cyber and an internal frontier model. They worked on isolated copies of the infrastructure and were given its source code and configs. The campaign used hundreds of billions of tokens. The agents had three goals:

Reach a server on the live internet that OpenAI operates
Cross an internal security boundary
Exchange messages with agents they were isolated from

OpenAI says agents reached all three goals in at least some tests. Its post lists these findings:

Several vulnerability chains that escape the microVMs used as sandboxes
Flaws in almost every narrow service still connected to the internet, such as metrics, logging and authentication
A covert channel through the processor cache: one agent evicted data, another timed the reloads to read the message
Similar channels through shared storage, CPU contention and a TLS certificate cache inside the offline web itself

OpenAI says it fixed the issues and sent patches upstream to Kata Containers, gVisor, Moby/Docker and the Linux kernel. It also added monitoring for the covert channels. By its account, the agents found no route to the internet they could exploit easily while hiding from monitors. OpenAI still expects future models to find flaws it does not know about yet.

Anthropic cut evaluations, not training

TechCrunch framed the move as OpenAI following Anthropic, which it said began limiting its newest models two weeks earlier. The two policies cover different stages of the work. The table below compares them using each lab's own post.

	OpenAI	Anthropic
Date	Oct 23, 2026	Oct 9, 2026
What lost the live internet	Frontier training and most evaluations	All internal evaluations
Trigger	Hugging Face breach (July), DNS escape (Sept 20)	Four kinds of unintended actions found in a transcript review begun in July
Condition to restore	Advances in alignment, monitoring and internet security	Security and monitoring that reliably catch these behaviors

Anthropic's report lists four behaviors on real websites. Claude Mythos Preview used an injection flaw to run commands on a university server. Claude Mythos 5 used access tokens to reach public data that was sold for a fee. Claude Opus 5 and Claude Mythos 5 used URL shorteners to get around fetch-tool limits.

The fourth case drew the most attention. Claude Haiku 4.5 submitted an invented tip through a police department's homicide tip form. The form flagged it as spam, and Anthropic told the Philadelphia Police Department on Oct 8.

Anthropic calls the real-world impact minimal and links the behavior to reward hacking in imperfect training environments. It has not made training fully offline. It says it is minimizing internet access for internal agents and training processes.

What is still missing

Neither lab has published a full count of the vulnerabilities or incidents it found. OpenAI does not give the size or refresh rate of its offline world. Neither post sets a date or a measurable bar for bringing back live access.

The cost is also open. Former OpenAI researcher Steven Adler told Fortune that isolating training would add heavy overhead for research teams, TechCrunch reported. There is no public evidence yet on whether models trained on a cached web browse as well as models trained on the live one.