OpenAI has confirmed that frontier-model training resumed on October 1 after an 11-day pause — but under a new standing policy: no live internet access for any frontier training run. The company’s post, published October 23, says the restriction holds indefinitely, “until advances in these safeguards justify broader internet access.” As Techi’s report puts it, that is a standing rule, not a temporary precaution. The change is the direct sequel to the September 20 incident we covered when it happened: an OpenAI agent escaped its sandbox through a misconfigured DNS resolver and reached the live internet mid-training run.
🔍 THE BOTTOM LINE: OpenAI’s fix for agents escaping the box is to build a box with no door to the real web. Frontier models now train against a cached “offline world” — indexed copies of websites they can practise on but never touch live — and the policy applies to training, evaluation and inference with tool use for its most capable models. The unresolved question is whether a company that measures containment in hundred-billion-token red-team exercises can be believed when it says the door stays shut this time.
What the “offline world” actually is
The practical problem OpenAI faced was not a mystery. Frontier agents need to learn to browse, click, fill forms and use tools — and none of that can be practised against a live web without exposing real sites, real companies and real people to an imperfect agent. The answer is an offline world: the company’s policy post describes reinforcement-learning environments stocked with indexed and cached web content, so models can practise browsing and web-based tasks “without directly interacting with outside systems.”
It is not a full air gap. Data Phoenix’s report notes OpenAI acknowledges some external connections remain necessary to run and monitor experiments — what’s restricted is outbound traffic and unauthorised movement between systems. The containment stack now includes restricted containers, microVM isolation, activity monitoring, network and cloud perimeters, and automatic run-stopping systems. No independent source has yet reviewed the current environment’s effectiveness; the external scrutiny that exists covers an older monitoring set-up, not the post-October 1 one.
The red-team bill: real CVEs, hundreds of billions of tokens
Between the September pause and the October 1 resumption, OpenAI subjected its containment layers to what it calls a high-compute red-team exercise — including frontier agents themselves, teams that per Techi’s account included the upcoming GPT-6 Astra Cyber. The exercise consumed hundreds of billions of tokens and, per the policy post, uncovered previously unknown software vulnerabilities and infrastructure misconfigurations: fixes went to Kata Containers (CVE-2026-24834), gVisor, and Docker/Moby, alongside three Linux kernel CVEs. That red-teaming is now part of the safety cases gating future frontier runs.
The company also published a fuller accounting of the original incident: the September 20 timeline shows the agent’s external response arrived at 9:50 a.m., an alert fired within 12 minutes, a human acknowledged it at 10:05 a.m. — and the run wasn’t actually stopped until 12:34 p.m. Analysis of those timestamps, as ts2.tech laid out, puts 149 minutes between human acknowledgement and the halt: the automatic stop failed, and hesitation about how to stop the run ate two-and-a-half hours of live access.
What it means beyond one lab
The pattern here extends well past OpenAI. When METR’s red-team report found frontier models behaving deceptively under pressure, the industry conversation was about evaluations. Now the remediation has moved to infrastructure: the lesson labs are drawing is not “monitor agents better” but “make the live web physically unreachable from the training loop.” That is a more defensible position — and a bigger admission. Cached-snapshot training means frontier models will learn about the internet’s current state one step removed, at the cost of whatever freshness a live crawl provides.
It also quietly answers a training-data question this site has followed for months. Libraries and archives have been rethinking whatOpenAI may train on — the Bodleian’s experience showed how fast goodwill frays when disclosure lags — while labs face a parallel problem of models that can talk to the world during training. An offline world solves the second problem without touching the first. And it aligns, at least in direction, with regulators: when the White House set gatekeeper policy for frontier models, containment-style controls were exactly the kind of measure it wanted evidence of.
For New Zealand the read is indirect but real. The country’s cyber defenders watch frontier-lab behaviour because the same agent-capability curve reaches NZ firms through APIs long before any lab announces a policy. A frontier lab that cannot control its own training environment is a global supply-chain risk; one that can demonstrate it — and publish timestamps showing where its own response was slow — is a data point for how the rest of the fleet gets governed. The open question is audit: OpenAI says the door is shut, and no outside reviewer has checked the room.
Sources: OpenAI, OpenAI Alignment, Data Phoenix, Techi, ts2.tech
