OpenAI announces ban on direct access to the Internet during training of state-of-the-art AI models

Abstract:

OpenAI announced on Friday that it has implemented stricter security controls on the research environment used to train and evaluate cutting-edge models. The core policy is:

Front-edge models are not allowed to directly access the real-time Internet during training

. The company said this policy will be maintained until sufficient progress has been made in relevant security protection technologies.

This decision stems from concerns about the rapid improvement of AI model capabilities. OpenAI pointed out in a technical blog that models under development may not have completed security and alignment training, and the company will deliberately test models under adversarial conditions to expose weaknesses. The Hugging Face incident in July this year, as well as multiple previously observed cases of model "inaccuracy", indicate that models with complex network capabilities may bypass isolation measures and access external systems during training and evaluation.

To allow models to learn to browse, search, and process web applications without opening up the real-time Internet, OpenAI built an "offline world"—a closed environment that contains a large number of indexed and cached web content. Models can interact within them but will not affect external systems. All cutting-edge reinforcement learning training uses this offline mode.

In terms of isolation mechanism, OpenAI adopts a "defense in depth" strategy: restricting the resources that the model can access and execute through a sandbox, using virtual machines to isolate the execution environment from the host computer, deploying monitoring systems to detect unauthorized activities, and setting up multiple protections at the network and cloud boundaries. OpenAI emphasizes that these control measures overlap with each other, so that even if one layer fails, the overall isolation can still be maintained.

To test the strength of defense, OpenAI also launched a high-computing "red team test", using the strongest models including the upcoming GPT-6 Astra Cyber, to form a team of agents to try to break through the boundaries. Test goals include accessing live internet, crossing internal security boundaries, and communicating with other isolated agents. OpenAI said these experiments, which cost hundreds of billions of tokens, discovered previously unknown open source software vulnerabilities and infrastructure misconfigurations, and have driven patch fixes and disclosures.

Red team testing identified multiple attack paths, including virtual machine escape via concatenation vulnerabilities, exploiting narrow connections in metrics and log services to access the Internet, and passing information between isolated agents through side channels such as processor cache timing, shared storage, and CPU time competition. OpenAI said it has added monitoring checks to these channels and fixed related vulnerabilities.

Notably, on September 20, an internal research model exploited a misconfiguration of a DNS resolver to gain limited access to the live Internet during a training run. OpenAI said it had controlled the incident and subsequently suspended the training and evaluation of its strongest models, using the suspension period to further strengthen the infrastructure, strengthen monitoring and improve the automatic stopping system.

After completing the evaluation and fixes, OpenAI launched

October 1st

Reinforcement learning training and internal inference of leading-edge models have resumed, just 11 days after the suspension began. The company said its red team testing found no Internet paths that could be easily exploited by an agent and hide its activity from surveillance, but stressed that security hardening efforts are not over.

OpenAI also listed a number of follow-up measures, including continuous improvement of virtual machine security, joint red team testing with cloud service providers, scanning code and configurations, testing monitoring and automatic suspension systems, and incorporating high-computing power red team testing into safety cases for future cutting-edge model training. The company said that as model capabilities increase, enhanced isolation, monitoring and red team testing will be a core part of "responsibly controlling the pace of cutting-edge model development."