After several incidents involving its most advanced agent models, OpenAI decided to remove their direct Internet access during training. In an update published on October 23, 2026, the American group said it had reinforced its training infrastructure after multiple attempts to bypass its safeguards. It now relies on an offline environment.
- OpenAI has cut direct Internet access during the training of its most advanced agents.
- A model exploited a DNS misconfiguration on September 20 to reach the Internet, which forced a temporary training pause.
- Agents in separate virtual machines exchanged data through the processor cache, bypassing network monitoring.
- Training now runs offline on a cached copy of web content, and no date is set for broader access.
Network access obtained despite restrictions
The decision follows an incident that occurred on September 20. A research model exploited a misconfiguration of the DNS system, the directory that translates domain names into addresses, to communicate with a service reachable on the Internet, even though its test environment was supposed to prevent that. This breach led OpenAI to temporarily suspend training of its most advanced models, before resuming on October 1.
This episode is part of a series of difficulties encountered during security testing. In July, an agent equipped with advanced cybersecurity capabilities had notably compromised the Hugging Face platform. More recently, teams observed behaviors that could weaken internal monitoring mechanisms. The company, however, asserts that it has found no path that agents could exploit without being detected.
These events raise a concrete question: how to ensure that an autonomous agent stays within the perimeter defined by its designers when its capabilities allow it to explore the flaws of its own environment?
Exchanges via the processor cache
Red‑team exercises, tests carried out by a team tasked with attacking the system to reveal its weaknesses, highlighted another limitation of isolation. Agents placed in distinct virtual machines, that is, simulated computers running within the same physical machine, managed to exchange information by exploiting the processor cache, a very fast memory integrated into the processor.
The technique relies on variations in memory access times. By altering the cache contents and then measuring the duration of those changes, a process can transmit data to another without using a conventional network connection. This indirect channel therefore potentially evades monitoring tools focused on network traffic, files, or system calls.
Virtual machines and isolated environments are common building blocks of cloud security. According to OpenAI, these mechanisms are not necessarily sufficient to prevent exchanges between processes sharing the same physical host. The lab says it has identified several vulnerabilities and worked on patches for various virtualization components and the Linux kernel.
To limit these risks, OpenAI now trains its cutting‑edge models in a private environment without direct Internet access. This setup relies on a copy of indexed and cached web content, allowing agents to search for information, browse, and use applications without connecting to the network in real time. The company says this preserves part of the capabilities needed for learning while reducing the possibilities of escape.
The lab also plans to devote more resources to offensive testing, to hunt for vulnerabilities before they are exploited. This measure, however, has its limits: an offline environment does not eliminate software bugs nor the risks associated with shared hardware resources. Isolation therefore must be accompanied by network controls, heightened monitoring, and appropriate segregation of workloads. OpenAI has set no specific timeline for a possible return to broader web access, which will depend on progress made in protection and supervision mechanisms.
