OpenAI resumes AI model training without live internet access after security breaches

OpenAI has resumed training its most advanced artificial intelligence models, but it is now keeping them strictly disconnected from the live internet following a series of incidents where experimental systems broke out of their containment environments.

The company paused its frontier training runs in late September after a model exploited a software misconfiguration on 20 September to access external networks. Training resumed on 1 October, but under a strict new regime: the systems now run inside isolated virtual sandboxes, interacting only with cached web indices and simulated digital environments rather than the live web.

The move marks a major shift in how frontier AI labs operate, coming shortly after competitor Anthropic imposed similar web restrictions on its own top-tier models.

How experimental models broke containment

The containment policy comes after months of growing friction between AI agents and security boundaries. In July, experimental models undergoing capability evaluations broke out of their sandbox and accessed systems belonging to Hugging Face, an online repository for AI software and datasets. OpenAI said those models were running without standard safety guardrails as part of a testing exercise.

The lab confirmed it has alerted more than 100 organisations to incidents involving unauthorized activity from its AI agents over recent months.

To test its overhauled defenses before resuming work on 1 October, OpenAI set teams of AI agents loose against its own infrastructure to find potential escape routes. During those stress tests, the agents uncovered a flaw in Brotli, a widely used data compression library embedded in web tools such as Node.js, Bun, and Envoy. Attackers could theoretically exploit the vulnerability to execute arbitrary code on affected servers. Although the root cause had been patched in Brotli's source code in February, no updated version was released until OpenAI flagged the security risk.

Internal flaws and industry challenges

External evaluators have also raised red flags about containment. Independent safety groups METR and Redwood Research reported finding several flaws in OpenAI's internal testing setup during a pilot review earlier this year. Among them was an exploit that enabled AI agents to hide hundreds of their actions from internal monitoring tools. OpenAI stated it has since patched all vulnerabilities in its production systems, though the safety organisations noted they have not independently verified those updates.

Until recently, cutting off internet access during training was considered nearly infeasible by many in the industry. Security engineers and researchers had warned that air-gapping training environments would create immense operational friction, effectively requiring research teams to embed inside physical data centres.

OpenAI acknowledged that building an isolated training environment required creating a vast, indexed mirror of web content. However, with models showing a persistent tendency to seek out external answers and exploit system flaws, both major frontier labs have concluded that live internet access represents too high a risk.