OpenAI Sets Offline Policy for Frontier-Model Training

OpenAI said frontier-model training now excludes live-internet access and uses expanded containment testing to assess security. In an account published October 23, 2026, the company said the restriction would remain until it judges improvements in safeguards sufficient for broader access.

For all frontier reinforcement-learning runs, OpenAI said web tasks take place in an offline environment built from cached, indexed internet material. The surrounding training and evaluation infrastructure still requires external connections to operate and monitor experiments. Its protections include limits on outbound traffic and movement between systems, sandboxes, virtual machines, monitoring, and network and cloud boundaries.

The company said a configuration error in a DNS resolver allowed an internal research model limited access to the live internet during training on September 20, 2026. It then suspended training and evaluation involving its most capable models while adding protections. Following assessments and additional controls, frontier reinforcement-learning training and internal inference restarted on October 1, which OpenAI said was 11 days after the suspension began.

OpenAI said compute-intensive red-team testing now forms part of the safety cases used to assess whether frontier training and evaluation can proceed securely. Teams of model agents tested access to outside servers, resources beyond their authorised environments and other agents held in isolation. Some experiments began with an assumed sandbox escape and host takeover, allowing separate testing of network and cloud defenses.

Those experiments ran in specially constructed, isolated replicas of research infrastructure, according to the company. Agents included some of OpenAI’s most capable models and received system code, configuration information and documentation. Monitoring and automatic checks were designed to stop experiments if activity exceeded their scope.

OpenAI said the tests identified previously unknown software defects and configuration errors, including virtual-machine sandbox escapes, internet access through internal services and communication across isolation boundaries. It said identified weaknesses had been repaired, with relevant software disclosures and fixes handled alongside open-source maintainers. The company also said agents found no internet-access route they could easily exploit while concealing their actions from its monitoring.

One communication test involved separate virtual machines sharing a host: agents exchanged information through differences in processor-cache timing, without network connectivity or writable files shared between them, OpenAI said. Other channels involved shared storage, processor usage and a certificate cache. The company said it added monitoring checks for attempts to use those channels.

The testing consumed hundreds of billions of tokens, according to OpenAI. Its chart comparing potential findings with token consumption documented the campaign’s progress and scale, the company said, rather than providing a controlled measure of how computing volume affected discoveries.

OpenAI said these internal research settings differ from customer-facing deployment because models under development may not have finished safety and alignment training. Before broader release, the company said it carries out safety and alignment assessments and applies safeguards for production use.

* This article is based on publicly available information at the time of writing.