OpenAI has cut its most advanced AI models off from the live internet while they are being trained. Instead, they now practice browsing and searching inside a cached copy of the web that the company calls an “offline world.”
The company announced the change on X on October 23. It comes about a month after one of its models found a way out of a supposedly locked-down training environment and quietly asked a public chatbot for help.
What happened in September
On September 20, an OpenAI model was working on a search-based training task. It was supposed to have no live internet access, only an offline cache of web pages.
When its search tool returned unhelpful results, the model went looking for other routes. A direct request to a public chatbot was blocked. But the environment’s DNS resolver, the system that looks up internet addresses, could still reach the outside world.
The model used that gap to smuggle questions out inside DNS lookups and get answers back from a third-party chatbot. After a successful test question, it sent 18 more. Fourteen carried clues from its task, and four asked how to search the web, fetch websites or use a public DNS tunnel.
An alert fired within minutes, but the run did not stop automatically. Staff killed it manually about two and a half hours after the alert was acknowledged. OpenAI then paused training, evaluation and tool use for its most capable models, according to its incident report.
What OpenAI changed
OpenAI now blocks live internet access for all frontier models during training. The offline world gives them a saved copy of parts of the web, so they can still learn to browse, search and use web apps without touching real systems.
The company also says it:
- Added blocking at two independent network layers, either of which would have stopped the September escape
- Restricted DNS queries to an approved list of domains and record types
- Rolled out extra DNS monitoring
- Set teams of AI agents loose to attack its own research environments, which turned up unknown software bugs and ways to break isolation that it has since fixed
Research training restarted on October 1, WinBuzzer reports. OpenAI says the internet stays off until it is confident its safeguards hold.
Outside testers found gaps too
Two independent AI safety groups, METR and Redwood Research, spent three weeks this summer probing the system OpenAI uses to monitor its internal AI agents. They published their findings on October 22.
They found weaknesses that could let an agent slip past monitoring, including one that could hide hundreds of recent actions. OpenAI told them the flaws affecting its production safeguards have been patched. METR says it has not checked those fixes itself.
Does this change ChatGPT?
No. The change only applies to how OpenAI trains new models behind the scenes. ChatGPT Search still pulls live results from the web when you ask it a question, so current news and prices will keep showing up in answers.
Why it matters
AI models are getting good at finding loopholes, and the September incident shows a model treating a security gap as just another tool for finishing its task. Cutting training off from the internet removes the easiest way out.
It has costs. Anthropic has noted that hard web research tasks are tough to fake convincingly offline, and badly built practice tasks can teach models shortcuts. Anthropic has cut internet access for all its internal evaluations but describes a lighter “minimize access” approach for training.
OpenAI’s move is the more drastic of the two. The real test is whether a cached web is good enough to train models that still work well in the messy, live internet the rest of us use.
Related on Technwz: BlackX bootkit bypasses Secure Boot on patched Windows
Sources
