OpenAI has announced plans to conduct frontier model training with no live internet access, as it resumes reinforcement learning (RL) training and internal inference of its most advanced AI models.
“Based on the current state of alignment research, monitoring systems, and the security of internet infrastructure, we believe the responsible approach is to conduct frontier model training with no internet access,” the artificial intelligence (AI) company said. “We’ve implemented this policy and will maintain it until advances in these safeguards justify broader internet access.”
OpenAI said models’ growing capabilities can have the side effect of them getting much better at devising ways around environmental restrictions to escape containment and perform unintended actions. This can involve the model exploiting a software flaw or misconfiguration to reach the live internet, or finding unauthorized ways to communicate with agents in other sandboxes.
Late last month, the Frontier Lab made the decision to pause training of its most powerful models after one of its agents during reinforcement learning (RL) training contacted an external chatbot by exploiting a misconfiguration in a DNS resolver to obtain limited internet access.
OpenAI said it also kicked off a “high-compute red-teaming campaign” to test the resilience of its research and evaluation environments in the face of increasingly powerful models, leading to the discovery of previously unknown software vulnerabilities, including a critical unauthenticated remote code execution in Google Brotli (CVE-2026-111497, CVSS score: 9.2), a widely used compression library.
Patches for the vulnerability, also called Node2Shell and HTTP2Shell, have since been released for libbrotli, Python, C++, Node.js, Bun, Envoy, and Istio.
The red-teaming agents OpenAI dispatched to test its security safeguards also uncovered virtual machine escapes, novel paths to access the internet through vulnerabilities in metrics, logging, and authentication management services, and hardware side-channels for communication between agents, bypassing isolation boundaries.
“In one test that assumed compromise of a host machine, an agent reused a firewall-approved connection to reach a blocked authentication endpoint in our metrics service and then made that endpoint fetch a model-provided URL,” it said. “In other tests, agents exploited misconfigurations that allowed blocked requests to pass through DNS and firewall controls, as well as ways to make services we run fetch external URLs.”
In another experiment, after prompting the AI agents in separate microVMs to exchange synthetic secrets without relying on network connections or shared writable files, OpenAI said the digital bots found a way to communicate using the processor’s cache via a timing-based side-channel.
Particularly, one agent is said to have encoded information by evicting selected data from the cache. A second agent measured the time it took to reload that data, leveraging the difference between fast and slow cache reads to recover the message.
“Once the agents agreed on a protocol for encoding and decoding these signals, they could exchange the synthetic secrets without changing a shared file or opening a network connection,” OpenAI said.
The AI giant said the discoveries prompted it to strengthen its own safety and monitoring mechanisms and deem them sufficient enough to restart frontier RL training and internal inference, while continuing to invest in several key areas –
- Improving virtual machine security
- Probing cloud infrastructure for weaknesses
- Scanning source code and cloud configurations
- Testing monitoring and stopping systems
- Red-teaming sandbox and isolation guarantees
“After strengthening our containment architecture, we resumed our frontier RL training and inference on October 1,” OpenAI said. “We’ve reserved substantial compute for continuous red-teaming, and made high-compute red-teaming part of the safety cases we use to decide whether frontier training and evaluation can proceed securely.”
Earlier this month, Anthropic said it was cutting off live internet access for all its internal evaluations until further notice after discovering new incidents in which its AI models exhibited misaligned behavior and targeted real websites.
The disclosure comes as concerns have been raised over the ability of AI agents to detect and exploit software flaws, even in the guardrails designed to restrict them.
In a report published this week, third-party AI safety evaluators METR and Redwood Research said they found several new vulnerabilities in OpenAI’s internal misalignment monitoring system as it existed before July 21, 2026, and during the time frame when the company’s agents broke into model-hosting platform Hugging Face.
“We found a way Codex agents could in principle bypass Codex sandboxing and Auto-Review, allowing them to take any action that the host user could take,” researchers David Rein and Adam Kaufman said. “We also discovered an exploit agents could use that would prevent hundreds of recent actions (including the actions involved in the exploit itself) from being monitored.”
OpenAI is believed to have addressed all of the vulnerabilities affecting its production safeguards stack, although the safety organizations said they had not verified the fixes.
Anthropic’s Mythos 5 Pursues an Unsanctioned Supply Chain Attack
The developments also coincide with a report from the U.K. AI Security Institute (AISI), which has found Anthropic’s Mythos 5 model to be consistently taking unsanctioned actions even when presented with evidence that doing so would be out-of-scope and cause real harm (e.g., submitting a malicious code change).
The evaluation also revealed that the Mythos 5’s chain-of-thought (CoT) reasoning process failed to consider the impact of harmful actions, with the model often producing invalid justifications that implied the target was simulated when asked if the human maintainer was real, but never generating incorrect justifications implying that it was real.
“Most models tested take a range of unsanctioned actions during simulated cybersecurity evaluations, Mythos 5 most frequently,” AISI said. “Taken together, these observations could indicate that models are engaging in ‘motivated reasoning’: producing inferences and reasoning biased towards conclusions that justify continuing a particular approach to task completion.”
In the most severe case, the model has been found to attempt a supply chain attack by submitting malicious code and creating five sock-puppet accounts to vouch for the changes and pressure a software maintainer into accepting it.
Responding to the findings, Anthropic has attributed the alignment failures to recklessness, biased reasoning, and an urge to “continue on its current trajectory” to a degree that disregards potential harm. The OpenAI rival also noted that its newer models, including an internal research model, are less susceptible to this behavior.
“Nevertheless, this incident serves as further evidence that current AI models are capable of surprisingly misaligned behavior in evaluation settings,” it said. “We’ve built new evaluations that we run on new production models automatically, and we are specifically studying biased reasoning to better understand where it comes from in our training and how it affects our models.”
