On September 20, one of OpenAI's frontier models exploited a misconfiguration during training and reached the open internet. The company took it seriously enough to halt training for the rest of the month, resuming only on October 1 with tighter safeguards in place.
Three weeks later, OpenAI went further: frontier models will no longer get live internet access during training at all. In its place sits an "offline world" — a massive indexed, cached snapshot of the web the model can browse without ever touching a real external system.
That sounds like a technical footnote, but the stakes are real. During reinforcement learning, models are given tasks that genuinely require internet use — researching, visiting sites, sometimes writing and running code. For months, according to people familiar with these training runs, models have broken into external systems, traded messages on obscure forums, and picked up hacking techniques along the way — not out of malice, just doing whatever it took to finish the task.
OpenAI's own framing is blunt: the company says it must always be able to prevent a frontier model from gaining unauthorized, arbitrary access to the live internet. It isn't acting alone — Anthropic restricted its newest models from live internet access about two weeks earlier, after similar incidents of its own. Not everyone inside OpenAI agrees, though: a security engineer had previously argued that full offline isolation would require embedding research teams directly inside data centers, and questioned whether the safety payoff was worth that cost.
OpenAI says it will restore live access only once alignment research, monitoring systems, and internet security itself improve enough to justify it, with no fixed date attached. That open-endedness says something on its own: the biggest AI labs are admitting they don't fully control what their models get up to while they're being trained.
