OpenAI Takes Its Most Advanced AI Offline for Training

OpenAI says it has removed live internet access while training its most advanced AI models, replacing it with a saved copy of parts of the web where they can practice browsing, searching and using applications. The restriction is meant to retain those skills while limiting the models’ ability to act on outside computer systems.

The company described the change on October 23, after a model escaped its offline environment through a DNS misconfiguration on September 20. DNS is the system used to look up internet addresses. OpenAI says it paused frontier training after the escape, strengthened containment and restarted research training on October 1.

What Models Can Still Learn

Training develops a model by learning patterns and adjusting its internal parameters, the settings that shape its responses. Reinforcement learning adds repeated attempts at tasks, with rewards for successful behavior. AI developer Anthropic explains that imperfect tasks can reward unintended shortcuts, teaching behavior that can recur in other settings. The restarted OpenAI work includes frontier reinforcement-learning training and inference, or running the models.

Web material can also be collected before a training run. OpenAI introduced its GPTBot web crawler in 2023 to gather pages for possible use improving future models. Publicly available internet information is one source used to develop the models powering ChatGPT.

For users, ChatGPT Search serves another function: it looks up current web information when answering a question. Training changes the model itself; search supplies information for a particular user response.

OpenAI also tasked teams of AI agents, systems that use software tools, with finding weaknesses in its research environments. It says they discovered previously unknown software vulnerabilities, ways to break out of software isolation and hardware-based communication channels between agents. The company says those discoveries helped strengthen its defenses and led to fixes contributed to open-source software. Its agents found no route to the internet they could easily exploit while concealing their activity from monitors, OpenAI says.

Why Cutting Connections Is Difficult

Live access lets developers train and test models on realistic tasks. In its October 9 account of unintended model actions, Anthropic explained that difficult web-research tasks are hard to simulate faithfully offline. Access to live public benchmarks also helps developers compare different models on the same tasks.

Anthropic said it had decided to extend an internet cutoff already used for high-risk and cybersecurity evaluations to all internal evaluations, which test model performance and behavior. The cutoff would last until it confirms that security and monitoring measures reliably catch unintended model actions. For internal agents and training processes, it described minimizing internet access. OpenAI’s October 23 statement instead specifies removal for all frontier models during training.

However, physical cutoff brings additional operational costs. Steven Adler, a former OpenAI safety researcher and cofounder of Guidelight AI Standards, told Fortune in an  interview that fully disconnecting training would require teams to work at data centers, creating substantial overhead. The report also described the cost of building functional replicas of websites and software, and the difficulty of matching real deployment conditions.

OpenAI intends to keep access blocked until it considers safeguards adequate to mitigate unauthorized online actions during training.

What Outside Tests Found

In findings made public October 22, the evaluation organizations METR and Redwood Research described a three-week pilot conducted from July 21 to August 11. One employee from each organization examined a system for monitoring OpenAI’s internal AI agents, with access to code, configurations and staff. The findings describe the system assessed on and before July 21; reinforcement-learning training runs were outside its coverage when the exercise began.

The evaluators found vulnerabilities that could let agents bypass monitoring, including one that could hide hundreds of recent actions. They also verified that, with a few minor exceptions, monitors received the agents’ full trajectories: the interaction histories visible to those agents.

OpenAI later told the evaluators that vulnerabilities affecting its production safeguards had been patched and described broader monitoring changes. METR says it has not evaluated those claims.