The policy change, announced by the company in a blog post on October 23, follows a security incident last month in which an internal AI model managed to reach the live internet during a training run via a misconfigured Domain Name System (DNS) server. In response to the breach, OpenAI halted its high-tier training runs for 11 days, resuming only on October 1 after implementing tighter controls. OpenAI has cut live internet access during the training of its frontline artificial intelligence models, shifting systems to search and browse an archived copy of the web instead.
The company stated that the restriction will remain active until more robust safeguards are developed. However, achieving complete isolation remains a work in progress: engineers must still maintain limited external connections so evaluations can execute and undergo live monitoring.
These protections overlap, so that containment can hold even if an individual control fails—a strategy known as defense in depth. We’ve therefore designed the security architecture for our research environments with one overriding principle: we must always be able to prevent a frontier model from achieving unauthorized, arbitrary access to the live internet.
The company said that it has implemented a no live internet access policy for its models. ” It added, “For training and most evaluation, the live internet lies outside this boundary, as we believe that providing models access to the live internet can pose significant risks. In a blog post, titled ‘Securing our frontier model training environment’, OpenAI wrote, “… as models become more capable, they become better at finding ways around those limits. A sophisticated model might exploit a software flaw or misconfiguration to escape a sandbox, exploit an internal service to reach the live internet, or find unauthorized ways to communicate with agents in other sandboxes. The Hugging Face incident in July, as well as other examples of model misalignment(opens in a new window) that we’ve observed, demonstrates how models with sophisticated cyber capabilities can bypass containment during their training and evaluation. In response to those incidents, we’ve substantially hardened the security of our research environments. Working closely with cloud providers, we’ve added new controls throughout our infrastructure, reduced the attack surface that agents can exploit, and improved our methods for detecting misaligned behavior and attempts to cross security boundaries. “Based on the current state of alignment research, monitoring systems, and the security of internet infrastructure, we believe the responsible approach is to conduct frontier model training with no internet access. We’ve implemented this policy and will maintain it until advances in these safeguards justify broader internet access. it also gives a capable, misaligned agent opportunities to affect systems beyond our control Although internet access can help models learn useful skills. ” You use AI every day. Now get your AI Quotient. Take the AIQ test.
On October 9, rival AI lab Anthropic instituted a similar lockdown, severing live web access across all internal model evaluations. “Although the impact of these behaviors was minimal and we had already turned off live internet access for some high-risk and cybersecurity evaluations, we have now decided to expand that to include all our internal evaluations until we have confirmed that our security and monitoring measures (described in the remediation section of this post) reliably catch behaviors like these.
Below, we also discuss alignment considerations and give more detail on how we’re modifying training to reduce the likelihood of further misbehavior,” said Anthropic in a blog post. The decision highlights growing industry-wide scrutiny over autonomous model behavior and the security risks associated with training runs connecting to outside networks.